121 September 2022: Wouter 2 - Patch for CVE-2022-3204 Non-Responsive Delegation Attack. 3 41 August 2022: Wouter 5 - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. 6 - Tests for ghost domain fixes. 7 819 July 2022: George 9 - Update documentation for 'outbound-msg-retry:'. 10 1119 July 2022: Wouter 12 - Merge #718: Introduce infra-cache-max-rtt option to config max 13 retransmit timeout. 14 1515 July 2022: Wouter 16 - Merge PR 714: Avoid treat normal hosts as unresponsive servers. 17 And fixup the lock code. 18 - iana portlist update. 19 2012 July 2022: George 21 - For windows crosscompile, fix setting the IPV6_MTU socket option 22 equivalent (IPV6_USER_MTU); allows cross compiling with latest 23 cross-compiler versions. 24 2512 July 2022: Wouter 26 - Fix dname count in sldns parse type descriptor for SVCB and HTTPS. 27 2811 July 2022: Wouter 29 - Fix verbose EDE error printout. 30 314 July 2022: George 32 - Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for 33 one loop pass'. 34 - Merge PR #668 from Cristian Rodríguez: Set IP_BIND_ADDRESS_NO_PORT on 35 outbound tcp sockets. 36 374 July 2022: Wouter 38 - Tag for 1.16.1rc1 release. This became 1.16.1 on 11 July 2022. 39 The code repo continues with version 1.16.2 under development. 40 413 July 2022: George 42 - Merge PR #671 from Petr Menšík: Disable ED25519 and ED448 in FIPS 43 mode on openssl3. 44 - Merge PR #660 from Petr Menšík: Sha1 runtime insecure. 45 - For #660: formatting, less verbose logging, add EDE information. 46 - Fix for correct openssl error when adding windows CA certificates to 47 the openssl trust store. 48 - Improve val_sigcrypt.c::algo_needs_missing for one loop pass. 49 - Reintroduce documentation and more EDE support for 50 val_sigcrypt.c::dnskeyset_verify_rrset_sig. 51 521 July 2022: George 53 - Merge PR #706: NXNS fallback. 54 - From #706: Cached NXDOMAIN does not increase the target nx 55 responses. 56 - From #706: Don't generate parent side queries if we already 57 have the lame records in cache. 58 - From #706: When a lame address is the best choice, don't try to 59 generate target queries when the missing targets are all lame. 60 6129 June 2022: Wouter 62 - iana portlist update. 63 - Fix detection of libz on windows compile with static option. 64 - Fix compile warning for windows compile. 65 6629 June 2022: George 67 - Add debug option to the mini_tdir.sh test code. 68 - Fix #704: [FR] Statistics counter for number of outgoing UDP queries 69 sent; introduces 'num.query.udpout' to the 'unbound-control stats' 70 command. 71 - Fix to not count cached NXDOMAIN for MAX_TARGET_NX. 72 - Allow fallback to the parent side when MAX_TARGET_NX is reached. 73 This will also allow MAX_TARGET_NX more NXDOMAINs. 74 7528 June 2022: George 76 - Show the output of the exact .rpl run that failed with 'make test'. 77 - Fix for cached 0 TTL records to not trigger prefetching when 78 serve-expired-client-timeout is set. 79 8028 June 2022: Wouter 81 - Fix test program dohclient close to use portability routine. 82 8323 June 2022: Tom 84 - Clarify -v flag manpage entry (#705) 85 8622 June 2022: Philip 87 - Fix #663: use after free issue with edns options. 88 8921 June 2022: Philip 90 - Fix for loading locally stored zones that have lines with blanks or 91 blanks and comments. 92 9320 June 2022: George 94 - Remove unused LDNS function check for GOST Engine unloading. 95 9614 June 2022: George 97 - Merge PR #688: Rpz url notify issue. 98 - Note in the unbound.conf text that NOTIFY is allowed from the url: 99 addresses for auth and rpz zones. 100 1013 June 2022: George 102 - Fix for edns client subnet to respect not looking in its cache when 103 instructed to do so (e.g., prefetch). 104 1053 June 2022: Wouter 106 - makedist.sh picks up 32bit libssp-0.dll when 32bit compile. 107 10827 May 2022: Wouter 109 - Fix #684: [FTBS] configure script error with libmnl on openSUSE 15.3 (and possibly other distributions) 110 - Version is set to 1.16.0 for release. Release tag 1.16.0rc1. This 111 became release 1.16.0 on 2 June 2022. The source code branch 112 continues with version 1.16.1 under development. 113 11420 May 2022: Wouter 115 - Fix to silence test for ede error output to the console from the 116 test setup script. 117 - Fix ede test to not use default pidfile, and use local interface. 118 - Fix some lint type warnings. 119 12018 May 2022: George 121 - Fix typos in config_set_option for the 'num-threads' and 122 'ede-serve-expired' options. 123 12415 May 2022: George 125 - Fix #678: [FR] modify behaviour of unbound-control rpz_enable zone, 126 by updating unbound-control's documentation. 127 12812 May 2022: George 129 - Fix #417: prefetch and ECS causing cache corruption when used 130 together. 131 13212 May 2022: Wouter 133 - Merge #677: Allow using system certificates not only on Windows, 134 from pemensik. 135 - For #677: Added tls-system-cert to config parser and documentation. 136 13711 May 2022: Wouter 138 - Fix #673: DNS over TLS: error: SSL_handshake syscall: No route to 139 host. 140 14110 May 2022: George 142 - Fix Python build in non-source directory; based on patch by 143 Michael Tokarev. 144 1456 May 2022: Tom 146 - Merge PR #604: Add basic support for EDE (RFC8914). 147 14828 April 2022: Wouter 149 - Fix #670: SERVFAIL problems with unbound 1.15.0 running on 150 OpenBSD 7.1. 151 1528 April 2022: Wouter 153 - Fix zonemd check to allow unsupported algorithms to load. 154 If there are only unsupported algorithms, or unsupported schemes, 155 and no failed or successful other ZONEMD records, or malformed 156 or bad ZONEMD records, the unsupported records allow the zone load. 157 - Fix zonemd unsupported algo check. 158 - Fix zonemd unsupported algo check reason to not copy to next record, 159 and check for success for debug printout. 160 - Fix zonemd unsupported algo check to print unsupported reason before 161 zeroing it. 162 - Fix zonemd unsupported algo check to set reason to NULL before the 163 check routine, but after malformed checks, to get the correct NULL 164 output when the digest matches. 165 16625 March 2022: Wouter 167 - Fix spelling error in comment in sldns_str2wire_svcparam_key_lookup. 168 16923 March 2022: Wouter 170 - Fix #651: [FR] Better logging for refused queries. 171 17218 March 2022: George 173 - Merge PR #648 from eaglegai: fix -q doesn't work when use with 174 'unbound-control stats_shm'. 175 17617 March 2022: Wouter 177 - Fix to describe auth-zone and other configuration at the local-zone 178 configuration option, to allow for more broadly view of the options. 179 18016 March 2022: Wouter 181 - Fix to ensure uniform handling of spaces and tabs when parsing RRs. 182 1839 March 2022: Wouter 184 - Merge #644: Make `install-lib` make target install the pkg-config 185 file. 186 1877 March 2022: Wouter 188 - Fix configure for python to use sysutils, because distutils is 189 deprecated. It uses sysutils when available, distutils otherwise. 190 1913 March 2022: Wouter 192 - Fix #637: Integer Overflow in sldns_str2period function. 193 - Fix for #637: fix integer overflow checks in sldns_str2period. 194 1952 March 2022: George 196 - Merge PR #632 from scottrw93: Match cnames in ipset. 197 - Various fixes for #632: variable initialisation, convert the qinfo 198 to str once, accept trailing dot in the local-zone ipset option. 199 2002 March 2022: Wouter 201 - Fix compile warnings for printf ll format on mingw compile. 202 2031 March 2022: Wouter 204 - Fix pythonmod for change in iter_dp_is_useless function prototype. 205 20628 February 2022: George 207 - Fix #630: Unify the RPZ log messages. 208 - Merge #623 from rex4539: Fix typos. 209 21028 February 2022: Wouter 211 - Fix #633: Document unix domain socket support for unbound-control. 212 - Fix for #633: updated fix with new text. 213 - Fix edns client subnet to add the option based on the option list, 214 so that it is not state dependent, after the state fix of #605 for 215 double EDNS options. 216 - Fix for edns client subnet option add fix in removal code, from review. 217 21825 February 2022: Wouter 219 - Fix to detect that no IPv6 support means that IPv6 addresses are 220 useless for delegation point lookups. 221 - update Makefile dependencies. 222 - Fix check interface existence for support detection in remote lookup. 223 22418 February 2022: Wouter 225 - Fix that address not available is squelched from the logs for 226 udp connect failures. It is visible on verbosity 4 and more. 227 - Merge #631 from mollyim: Replace OpenSSL's ERR_PACK with 228 ERR_GET_REASON. 229 23016 February 2022: Wouter 231 - Fix for #628: fix rpz-passthru for qname trigger by localzone type. 232 23315 February 2022: Wouter 234 - Fix #628: A rpz-passthru action is not ending RPZ zone processing. 235 23611 February 2022: Wouter 237 - Fix #624: Unable to stop Unbound in Windows console (does not 238 respond to CTRL+C command). 239 - Fix #618: enabling interface-automatic disables DNS-over-TLS. 240 Adds the option to list interface-automatic-ports. 241 - Remove debug info from #618 fix. 242 2437 February 2022: Wouter 244 - Fix that TCP interface does not use TLS when TLS is also configured. 245 2464 February 2022: Wouter 247 - Fix #412: cache invalidation issue with CNAME+A. 248 2493 February 2022: Wouter 250 - Fix for #611: Integer overflow in sldns_wire2str_pkt_scan. 251 - Tag for 1.15.0rc1 created. That became 1.15.0 on 10 feb 2022. 252 The repository continues with version 1.15.1. 253 2542 February 2022: George 255 - Merge PR #532 from Shchelk: Fix: buffer overflow bug. 256 - Merge PR #616: Update ratelimit logic. It also introduces 257 ratelimit-backoff and ip-ratelimit-backoff configuration options. 258 - Change aggressive-nsec default to yes. 259 - Merge PR #617: Update stub/forward-host notation to accept port and 260 tls-auth-name. 261 - Update stream_ssl.tdir test to also use the new forward-host 262 notation. 263 2642 February 2022: Wouter 265 - Update version number in repo to 1.15.0 for upcoming release, 266 since it changes the aggressive-nsec default and the ratelimit change. 267 - Fix header comment for doxygen for authextstrtoaddr. 268 - please clang analyzer for loop in test code. 269 - Fix docker splint test to use more portable uname. 270 - Update contrib/aaaa-filter-iterator.patch with diff for current 271 software version. 272 2731 February 2022: George 274 - Merge PR #603 from fobser: Use OpenSSL 1.1 API to access DSA and RSA 275 internals. 276 27731 January 2022: George 278 - Fix review comment for use-after-free when failing to send UDP out. 279 28031 January 2022: Wouter 281 - iana portlist update. 282 28329 January 2022: George 284 - Fix tls-* and ssl-* documented alternate syntax to also be available 285 through remote-control and unbound-checkconf. 286 - Better cleanup on failed DoT/DoH listening socket creation. 287 28826 January 2022: George 289 - Fix #599: [FR] RFC 9156 (obsoletes RFC 7816), by noting the new RFC 290 document. 291 29226 January 2022: Wouter 293 - Test for NSID in SERVFAIL response due to DNSSEC bogus. 294 29525 January 2022: George 296 - Fix #588: Unbound 1.13.2 crashes due to p->pc is NULL in 297 serviced_udp_callback. 298 - Merge PR #612: TCP race condition. 299 30025 January 2022: Wouter 301 - Fix #610: Undefine-shift in sldns_str2wire_hip_buf. 302 30319 January 2022: George 304 - For dnstap, do not wakeupnow right there. Instead zero the timer to 305 force the wakeup callback asap. 306 30714 January 2022: George 308 - Merge PR #605: 309 - Fix EDNS to upstream where the same option could be attached 310 more than once. 311 - Add a region to serviced_query for allocations. 312 31314 January 2022: Wouter 314 - Add rpz: for-downstream: yesno option, where the RPZ zone is 315 authoritatively answered for, so the RPZ zone contents can be 316 checked with DNS queries directed at the RPZ zone. 317 - For #602: Allow the module-config "subnetcache validator cachedb 318 iterator". 319 32011 January 2022: George 321 - Fix prematurely terminated TCP queries when a reply has the same ID. 322 3237 January 2022: Wouter 324 - Merge #600 from pemensik: Change file mode before changing file 325 owner. 326 3275 January 2022: Wouter 328 - Fix for #596: fix that rpz return message is returned and not just 329 the rcode from the iterator return path. This fixes signal unset RA 330 after a CNAME. 331 - Fix unit tests for rpz now that the AA flag returns successfully from 332 the iterator loop. 333 - Fix for #596: add unit test for nsdname trigger and signal unset RA. 334 - Fix for #596: add unit test for nsip trigger and signal unset RA. 335 - Fix #598: Fix unbound-checkconf fatal error: module conf 336 'respip dns64 validator iterator' is not known to work. 337 - Fix for #596: Fix rpz-signal-nxdomain-ra to work for clientip 338 triggered operation. 339 3404 January 2022: Wouter 341 - Fix #596: unset the RA bit when a query is blocked by an unbound 342 RPZ nxdomain reply. The option rpz-signal-nxdomain-ra allows to 343 signal that a domain is externally blocked to clients when it 344 is blocked with NXDOMAIN by unsetting RA. 345 - Fix to add test for rpz-signal-nxdomain-ra. 346 - Fix #596: only unset RA when NXDOMAIN is signalled. 347 - Fix that RPZ does not set RD flag on replies, it should be copied 348 from the query. 349 35022 December 2021: George 351 - contrib/aaaa-filter-iterator.patch file renewed diff content to 352 apply cleanly to the current coderepo for the current code version. 353 35420 December 2021: George 355 - Fix #591: Unbound-anchor manpage links to non-existent license file. 356 35713 December 2021: George 358 - Add missing configure flags for optional features in the 359 documentation. 360 - Fix Unbound capitalization in the documentation. 361 36213 December 2021: Wouter 363 - Fix to pick up other class local zone information before unlock. 364 36510 December 2021: George 366 - Allow local-data for classes other than IN to inherit a configured 367 local-zone's type if possible, instead of defaulting to type 368 transparent as per the implicit rule. 369 37010 December 2021: Wouter 371 - Add code similar to fix for ldns for tab between strings, for 372 consistency, the test case was not broken. 373 3746 December 2021: Wouter 375 - Merge PR #581 from fobser: Fix -Wmissing-prototypes and -Wshadow 376 warnings in rpz. 377 - Fix validator debug output about DS support, print correct algorithm. 378 3793 December 2021: Wouter 380 - Fix compile warning for if_nametoindex on windows 64bit. 381 3821 December 2021: Wouter 383 - configure is set to 1.14.0, and release branch. 384 This was released as version 1.14.0 on 9 Dec 2021, with the doxygen 385 fix below included. The main branch continues as 1.14.1. 386 - Fix doc/unbound.doxygen to remove obsolete tag warning. 387 3881 December 2021: George 389 - Merge PR #511 from yan12125: Reduce unnecessary linking. 390 - Merge PR #493 from Jaap: Fix generation of libunbound.pc. 391 - Merge PR #555 from fobser: Allow interface names as scope-id in IPv6 392 link-local addresses. 393 - Merge PR #562 from Willem: Reset keepalive per new tcp session. 394 - Merge PR #522 from sibeream: memory management violations fixed. 395 - Merge PR #530 from Shchelk: Fix: dereferencing a null pointer. 396 - Fix #454: listen_dnsport.c:825: error: ‘IPV6_TCLASS’ undeclared. 397 - Fix #574: Review fixes for size allocation. 398 39930 November 2021: Wouter 400 - Fix to remove git tracking and ci information from release tarballs. 401 - iana portlist update. 402 40329 November 2021: Wouter 404 - Merge PR #570 from rex4539: Fix typos. 405 - Fix for #570: regen aclocal.m4, fix configure.ac for spelling. 406 - Fix to make python module opt_list use opt_list_in. 407 - Fix #574: unbound-checkconf reports fatal error if interface names 408 are used as value for interfaces: 409 - Fix #574: Review fixes for it. 410 - Fix #576: [FR] UB_* error codes in unbound.h 411 - Fix #574: Review fix for spelling. 412 41315 November 2021: Tom 414 - Improve EDNS option handling, now also works for synthesised 415 responses such as local-data and server.id CH TXT responses. 416 4175 November 2021: George 418 - Fix for #558: fix loop in comm_point->tcp_free when a comm_point is 419 reclaimed more than once during callbacks. 420 - Fix for #558: clear the UB_EV_TIMEOUT bit before adding an event. 421 4225 November 2021: Wouter 423 - Fix that forward-zone name is documented as the full name of the 424 zone. It is not relative but a fully qualified domain name. 425 - Fix analyzer review failure in rpz action override code to not 426 crash on unlocking the local zone lock. 427 - Fix to remove unused code from rpz resolve client and action 428 function. 429 - Merge #565: unbound.service.in: Disable ProtectKernelTunables again. 430 4312 November 2021: Wouter 432 - Fix #552: Unbound assumes index.html exists on RPZ host. 433 43411 October 2021: Wouter 435 - Fix chaos replies to have truncation for short message lengths, 436 or long reply strings. 437 - Fix to protect custom regional create against small values. 438 4394 October 2021: Wouter 440 - Fix to add example.conf note for outbound-msg-retry. 441 44227 September 2021: Wouter 443 - Implement RFC8375: Special-Use Domain 'home.arpa.'. 444 44521 September 2021: Wouter 446 - For crosscompile on windows, detect 64bit stackprotector library. 447 - Fix crosscompile shell syntax. 448 - Fix crosscompile windows to use libssp when it exists. 449 - For the windows compile script disable gost. 450 - Fix that on windows, use BIO_set_callback_ex instead of deprecated 451 BIO_set_callback. 452 - Fix crosscompile script for the shared build flags. 453 45420 September 2021: Wouter 455 - Fix crosscompile on windows to work with openssl 3.0.0 the 456 link with ws2_32 needs -l:libssp.a for __strcpy_chk. 457 Also copy results from lib64 directory if needed. 458 45910 September 2021: Wouter 460 - Fix initialisation errors reported by gcc sanitizer. 461 - Fix lock debug code for gcc sanitizer reports. 462 - Fix more initialisation errors reported by gcc sanitizer. 463 4648 September 2021: Wouter 465 - Merged #41 from Moritz Schneider: made outbound-msg-retry 466 configurable. 467 - Small fixes for #41: changelog, conflicts resolved, 468 processQueryResponse takes an iterator env argument like other 469 functions in the iterator, no colon in string for set_option, 470 and some whitespace style, to make it similar to the rest. 471 - Fix for #41: change outbound retry to int to fix signed comparison 472 warnings. 473 - Fix root_anchor test to check with new icannbundle date. 474 4753 September 2021: Wouter 476 - Fix #538: Fix subnetcache statistics. 477 4781 September 2021: Wouter 479 - Fix tcp fastopen failure when disabled, try normal connect instead. 480 48127 August 2021: Wouter 482 - Fix #533: Negative responses get cached even when setting 483 cache-max-negative-ttl: 1 484 48525 August 2021: Wouter 486 - Merge #401: RPZ triggers. This add additional RPZ triggers, 487 unbound supports a full set of rpz triggers, and this now 488 includes nsdname, nsip and clientip triggers. Also actions 489 are fully supported, and this now includes the tcp-only action. 490 - Fix #536: error: RPZ: name of record (drop.spamhaus.org.rpz.local.) 491 to insert into RPZ. 492 - Fix the stream wait stream_wait_count_lock and http2 buffer locks 493 setup and desetup from race condition. 494 - Fix RPZ locks. Do not unlock zones lock if requested and rpz find 495 zone does not find the zone. Readlock the clientip that is found 496 for ipbased triggers. Unlock the nsdname zone lock when done. 497 Unlock zone and ip in rpz nsip and nsdname callback. Unlock 498 authzone and localzone if clientip found in rpz worker call. 499 - Fix compile warning in libunbound for listen desetup routine. 500 - Fix asynclook unit test for setup of lockchecks before log. 501 50220 August 2021: Wouter 503 - Fix #529: Fix: log_assert does nothing if UNBOUND_DEBUG is 504 undefined. 505 - Fix #531: Fix: passed to proc after free. 506 50717 August 2021: Wouter 508 - Fix that --with-ssl can use "/usr/include/openssl11" to pass the 509 location of a different openssl version. 510 - Fix #527: not sending quad9 cert to syslog (and may be more). 511 - Fix sed script in ssldir split handling. 512 51316 August 2021: George 514 - Merge PR #528 from fobser: Make sldns_str2wire_svcparam_buf() 515 static. 516 51716 August 2021: Wouter 518 - Fix to support harden-algo-downgrade for ZONEMD dnssec checks. 519 52013 August 2021: Wouter 521 - Support using system-wide crypto policies. 522 - Fix for #431: Squelch permission denied errors for udp connect, 523 and udp send, they are visible at higher verbosity settings. 524 - Fix zonemd verification of key that is not in DNS but in the zone 525 and needs a chain of trust. 526 - zonemd, fix order of bogus printout string manipulation. 527 52812 August 2021: George 529 - Merge PR #514, from ziollek: Docker environment for run tests. 530 - For #514: generate configure. 531 53212 August 2021: Wouter 533 - And 1.13.2rc1 became the 1.13.2 with the fix for the python module 534 build. The current code repository continues with version 1.13.3. 535 - Add test tool readzone to .gitignore. 536 - Merge #521: Update mini_event.c. 537 - Merge #523: fix: free() call more than once with the same pointer. 538 - Merge #519: Support for selective enabling tcp-upstream for 539 stub/forward zones. 540 - For #519: note stub-tcp-upstream and forward-tcp-upstream in 541 the example configuration file. 542 - For #519: yacc and lex. And fix python bindings, and test program 543 unbound-dnstap-socket. 544 - For #519: fix comments for doxygen. 545 - Fix to print error from unbound-anchor for writing to the key 546 file, also when not verbose. 547 5485 August 2021: Wouter 549 - Tag for 1.13.2rc1 release. 550 - Fix #520: Unbound 1.13.2rc1 fails to build python module. 551 5524 August 2021: George 553 - Merge PR #415 from sibeream: Use 554 /proc/sys/net/ipv4/ip_local_port_range to determine available outgoing 555 ports. (New --enable-linux-ip-local-port-range configuration option) 556 - Bump MAX_RESTART_COUNT to 11 from 8; in relation to #438. This 557 allows longer CNAME chains in Unbound. 558 5594 August 2021: Wouter 560 - In unit test use openssl set security level to allow keys in test. 561 - Fix static analysis warnings about localzone locks that are unused. 562 - Fix missing locks in zonemd unit test. 563 - Fix readzone compile under debug config. 564 - Fix out of sourcedir run of zonemd unit tests. 565 - Fix libnettle zonemd unit test. 566 - Fix unit test zonemd_reload for use in run_vm. 567 5683 August 2021: George 569 - Listen to read or write events after the SSL handshake. 570 Sticky events on windows would stick on read when write was needed. 571 5723 August 2021: Wouter 573 - Merge PR #517 from dyunwei: #420 breaks the mesh reply list 574 function that need to reuse the dns answer. 575 - Annotate assertion into error printout; we think it may be an 576 error, but the situation looks harmless. 577 - Fix sign comparison warning on FreeBSD. 578 5792 August 2021: Wouter 580 - Prepare for OpenSSL 3.0.0 provider API usage, move the sldns 581 keyraw functions to produce EVP_PKEY results. 582 - Move RSA and DSA to use OpenSSL 3.0.0 API. 583 - Move ECDSA functions to use OpenSSL 3.0.0 API. 584 - iana portlist update. 585 - Fix verbose printout failure in tcp reuse unit test. 586 58730 July 2021: Wouter 588 - Fix #515: Compilation against openssl 3.0.0 beta2 is failing to 589 build unbound. 590 - For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and 591 SSL_get_peer_certificate. 592 - Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check. 593 59426 July 2021: George 595 - Merge #513: Stream reuse, attempt to fix #411, #439, #469. This 596 introduces a couple of fixes for the stream reuse functionality 597 that could result in broken internal structures. 598 59926 July 2021: Wouter 600 - Merge #512: unbound.service.in: upgrade hardening to latest 601 standards. 602 - Fix readzone unknown type print for memory resize. 603 60421 July 2021: Wouter 605 - Fix that ldns_zone_new_frm_fp_l counts the line number for an empty 606 line after a comment. 607 60816 July 2021: George 609 - Introduce 'http-user-agent:' and 'hide-http-user-agent:' options. 610 61116 July 2021: Wouter 612 - Merge #510 from ndptech: Don't call a function which hasn't been 613 defined. 614 - Fix for #510: in depth, use ifdefs for windows api event calls. 615 - Fix spelling in doc/unbound.doxygen comment. 616 - Fix spelling in localzone.h comment. 617 - Fix unbound-control local_data and local_datas to print detailed 618 syntax errors. 619 - review fix to remove duplicate error printout. 620 - Insert header into testcode/readzone.c, it was missing. 621 - Fix from lint for ignored return value. 622 - Fix for older parsers for function call in serve expired get cached. 623 6246 July 2021: Wouter 625 - iana portlist update. 626 6275 July 2021: George 628 - Fix compiler warnings for #491. 629 - Fix clang-analysis warnings for testcode/readzone.c. 630 6314 July 2021: George 632 - Fix Wunused-result compile warnings. 633 6342 July 2021: Tom 635 - Merge PR #491: Add SVCB and HTTPS types and handling according to 636 draft-ietf-dnsop-svcb-https. 637 6382 July 2021: Wouter 639 - Fix #506: Python Module Seems to Leak Memory if it Experiences an 640 Unhandled Exception. 641 64225 June 2021: Wouter 643 - Fix up permissions on rpl data file in tests. 644 - Fix testbound newline treatment in moment_read and tempfile write. 645 - Fix configure grep for reuseport default for failure. 646 - Fix compat ctime_r return value 647 - Fix configure does not require pkg-config if not needed. 648 - Fix unit test in the ctime_r calls for autotrust and in testbound. 649 - Fix auth zone download on windows to unlink before rename. 650 65124 June 2021: Wouter 652 - Add analyzer and port compile github workflow. 653 65423 June 2021: Wouter 655 - Fix #503: DNS over HTTPS response truncated. 656 - Fix warnings reported by the gcc analyzer. 657 65821 June 2021: George 659 - Fix #495: Documentation or implementation of "verbosity" option. 660 66118 June 2021: Wouter 662 - Fix a number of warnings reported by the gcc analyzer. 663 66415 June 2021: George 665 - Merge #440 by kimheino: Various fixes to contrib/unbound_munin_ file. 666 66714 June 2021: Wouter 668 - Fix configure nonblocking test and onmingw test to use host. 669 67010 June 2021: Wouter 671 - Fix #500: SPEC file in version 1.13.1 references version 1.4; 672 unable to build RPM from source. 673 - Fix contrib/unbound.spec, fixed url and comment. 674 6759 June 2021: George 676 - Merge #486 by fobster: Make VAL_MAX_RESTART_COUNT configurable. 677 - Generated lexer and parser for #486; updated example.conf. 678 - Fix #413 (based on patch by k-ronny): unbound: does not compile 679 on macOS 11.1-x86_64 host. 680 - Use host_os instead of target_os in configure for Darwin8 build. 681 6828 June 2021: George 683 - Fix unused variable warning when compiling with --enable-dnstap. 684 6857 June 2021: George 686 - Merge #448 from shoeper: Update unbound-control.8.in, fix 687 rpz_disable typo. 688 - Fix #425: Document auth-zone supports communication with DNS 689 primary on nondefault port. 690 6911 June 2021: George 692 - Fix test for zonemd-check option. 693 69427 May 2021: Wouter 695 - Merge #496 from banburybill: Use build system endianness if 696 available, otherwise try to work it out. 697 - zonemd-check: yesno option, default no, enables the processing 698 of ZONEMD records for that zone. 699 70025 May 2021: Wouter 701 - Move the NSEC3 max iterations count in line with the 150 value 702 used by BIND, Knot and PowerDNS. This sets the default value 703 for it in the configuration to 150 for all key sizes. 704 - Fix #492: module-config respip missing in unbound.conf.5.in man 705 page. Merges #494 from he32. 706 - For #492: Fix font highlighting for the man page on emacs. 707 70821 May 2021: Wouter 709 - Test code has -q option for quiet output. 710 71119 May 2021: George 712 - Fix for #411, #439, #469: Reset the DNS message ID when moving queries 713 between TCP streams. 714 - Refactor for uniform way to produce random DNS message IDs. 715 71617 May 2021: Wouter 717 - Fix #489: Compile using MSYS2 MinGW 64-bit. 718 71912 May 2021: Wouter 720 - Fix that auth-zone zonefiles use last TTL if no TTL is specified. 721 72210 May 2021: Wouter 723 - Merge PR #487: ifdef RLIMIT_AS in recently added check. 724 7257 May 2021: Wouter 726 - Fix #485: Unbound occasionally reports broken stats. 727 - Add ./configure --with-deprecate-rsa-1024 that turns off RSA 1024. 728 - Remove case fallthrough from deprecate-rsa-1024 code. 729 7304 May 2021: George 731 - Fix for #367: only attempt to get the interface for queries that are no 732 longer on the tcp_waiting_list. 733 - Add more logging for out-of-memory cases. 734 7354 May 2021: Wouter 736 - Merge #478: Allow configuration of TCP timeout while waiting for 737 response. 738 - Fix to squelch tcp socket bind failures when the interface is gone. 739 - Rerun flex and bison. 740 7413 May 2021: Wouter 742 - Fix #481: Fix comment in configuration file. 743 74429 April 2021: Wouter 745 - Add that log-servfail prints an IP address and more information 746 about one of the last failures for that query. 747 74828 April 2021: George 749 - Fix compiler warning for signed/unsigned comparison for 750 max_reuse_tcp_queries. 751 75228 April 2021: Wouter 753 - Fix #474: always_null and others inside view. 754 75526 April 2021: Wouter 756 - Merge #470 from edevil: Allow configuration of persistent TCP 757 connections. 758 75922 April 2021: Wouter 760 - Merge #466 from FGasper: Support OpenSSLs that lack 761 SSL_get0_alpn_selected. 762 - Fix #468: OpenSSL 1.0.1 can no longer build Unbound. 763 - Further fix for #468: detect SSL_CTX_set_alpn_protos for build with 764 OpenSSL 1.0.1. 765 - Fix that testcode dohclient has OpenSSL initialisation calls. 766 76713 April 2021: George 768 - Fix documentation comment for files previously residing in checkconf/. 769 - Remove unused functions worker_handle_reply and libworker_handle_reply. 770 77113 April 2021: Wouter 772 - Fix that nxdomain synthesis does not happen above the stub or 773 forward definition. 774 77512 April 2021: George 776 - Fix (increase) verbosity level for iterator error log in 777 processQueryTargets(). 778 77912 April 2021: Wouter 780 - Fix permission denied sendto log, squelch the log messages 781 unless high verbosity is set. 782 7839 April 2021: Wouter 784 - rebuild configure to set EXTRALINK to libunbound.la for #460. 785 7867 April 2021: Wouter 787 - Fix for #411: Depth protect for crash on deleted element timeout. 788 7891 April 2021: Wouter 790 - Merge #460 from orbea: build: Link with the libtool archive. 791 - Fix to stop IPv6 PMTU discovery. 792 79331 March 2021: George 794 - Clean makedist.sh. 795 79631 March 2021: Wouter 797 - Fix stack-protector change to not override other CFLAGS options. 798 79930 March 2021: George 800 - Disable the use of stack-protector for cross compiled 32-bit windows 801 builds; relates to #444. 802 80325 March 2021: Wouter 804 - Fix #429: Also fix end of transfer for http download of auth zones. 805 80624 March 2021: Wouter 807 - Fix deprecation test to work for iOS TVOS and WatchOS, it uses 808 CFLAGS and CPPFLAGS and also checks if the item is unavailable. 809 - Travis, fix script to fail when tasks fail. 810 - Travis, fix warning in ubsan compile. 811 - Fix configure Targetconfiditionals.h header check, to use compile. 812 - Fix that cachedb does not produce empty object files when disabled. 813 81423 March 2021: Wouter 815 - Travis enable all tests again. Clang analyzer only a couple times, 816 when there is a difference. homebrew updates disabled, so it does 817 not hang. removed trailing slashes from configure paths. Moved iOS 818 tests to allow-failure. 819 - travis, analyzer disabled on test without debug, that does not 820 run anway. Turn off failing tests except one. Update iOS test 821 to xcode image 12.2. 822 82322 March 2021: George 824 - Fix unused-function warning when compiling with --enable-dnscrypt. 825 - Fix for #367: fix memory leak when cannot bind to listening port. 826 - Reformat pythonmod/pythonmod_utils.{c,h}. 827 82822 March 2021: Wouter 829 - Merge #449 from orbea: build: Add missing linker flags. 830 - iana portlist update. 831 - Comment out nonworking OSX and IOS travis tests, vm fails to start. 832 - Fix compile error in listen_dnsport on Android. 833 - Fix memory leak reported by asan in rpz SOA record query name. 834 83519 March 2021: Wouter 836 - Fix for #447: squelch connection refused tcp connection failures 837 from the log, unless verbosity is high. 838 83917 March 2021: Wouter 840 - Fix #441: Minimal NSEC range not accepted for top level domains. 841 84211 March 2021: Wouter 843 - Fix parse of LOC RR type for decimetres. 844 8455 March 2021: Wouter 846 - Workaround for #439: prevent loops in the reuse rbtree. 847 - Debug output for #411 and #439: printout internal error and details. 848 8494 March 2021: Wouter 850 - iana portlist update. 851 - Fix spurious errors about "Could not generate request: out of 852 memory". The mesh detect cycle routine no longer wrongly stops 853 the check when the calling mesh state is unique. 854 85526 February 2021: George 856 - Fix for #367: rc_ports don't have ub_sock; skip cleaning up. 857 85826 February 2021: Wouter 859 - Fix: Resolve interface names on control-interface too. 860 86125 February 2021: Wouter 862 - Merge PR #367 : DNSTAP log local address. With code from PR #365 863 and fixes #368 : dnstap does not log the DNS message ID for 864 FORWARDER_QUERY. 865 - Fix to allow rpz with wildcard that applies to all TLDs at once. 866 86724 February 2021: George 868 - Fix #384: (1) A minor request to improve the log (2) A minor bug in one 869 log message. 870 - ipsecmod: Better logging for detecting a cycle when attaching the 871 A/AAAA subquery. 872 87324 February 2021: Wouter 874 - On startup of unbound it checks if rlimits on memory size look 875 sufficient for the configured cache size, and logs warning if not. 876 - Fix function documentation. 877 - Fix unit test for added ulimit checks. 878 - spelling fix in header. 879 88023 February 2021: Wouter 881 - Fix for zonemd, that domain-insecure zones work without dnssec. 882 - Fix for zonemd, do not reject insecure result from trust anchor 883 validation step in dnssec chain of trust. 884 88522 February 2021: Wouter 886 - Fix #431: Squelch permission denied errors for tcp connect 887 and udp connect from the logs, unless at high verbosity. 888 - Fix for zonemd, that nxdomain for the chain of trust is allowed 889 for island zones, it is treated as an insecure zone for verification. 890 89118 February 2021: Wouter 892 - Merge PR #317: ZONEMD Zone Verification, with RFC 8976 support. 893 ZONEMD records are checked for zones loaded as auth-zone, 894 with DNSSEC if available. There is an added option 895 zonemd-permissive-mode that makes it log but not fail wrong zones. 896 With zonemd-reject-absence for an auth-zone the presence of a 897 zonemd can be mandated for specific zones. 898 - Fix doxygen and pydoc warnings. 899 - Fix #429: rpz: url: with https: broken (regression in 1.13.1). 900 - rpz skip nsec3param records, and nicer log for unsupported actions. 901 90215 February 2021: Wouter 903 - Fix #422: IPv6 fallback issues when IPv6 is not properly 904 enabled/configured. 905 - Fix to make tests work with support indicators set for iterator. 906 - Fix build on Python 3.10. 907 90810 February 2021: Wouter 909 - Merge PR #420 from dyunwei: DOH not responsing with 910 "http2_query_read_done failure" logged. 911 9129 February 2021: Wouter 913 - Fix for Python 3.9, no longer use deprecated functions of 914 PyEval_CallObject (now PyObject_Call), PyEval_InitThreads (now 915 none), PyParser_SimpleParseFile (now Py_CompileString). 916 9174 February 2021: Wouter 918 - release 1.13.1rc2 tag on branch-1.13.1 with added changes of 2 feb. 919 This became 1.13.1 release tag on 9 feb. The main branch is set 920 to version 1.13.2. 921 9222 February 2021: Wouter 923 - branch-1.13.1 is created, with release-1.13.1rc1 tag. 924 - Fix dynlibmod link on rhel8 for -ldl inclusion. 925 - Fix windows dependency on libssp.dll because of default stack 926 protector in mingw. 927 - Fix indentation of root anchor for use by windows install script. 928 9291 February 2021: George 930 - Attempt to fix NULL keys in the reuse_tcp tree; relates to #411. 931 93229 January 2021: Wouter 933 - Fix for doxygen 1.8.20 compatibility. 934 93528 January 2021: Wouter 936 - Annotate that we ignore the return value of if_indextoname. 937 - Fix to use correct type for label count in rpz routine. 938 - Fix empty clause warning in config_file nsid parse. 939 - Fix to use correct type for label count in ipdnametoaddr rpz routine. 940 - Fix empty clause warning in edns pass for padding. 941 - Fix fwd ancil test post script when not supported. 942 94326 January 2021: George 944 - Merge PR #408 from fobser: Prevent a few more yacc clashes. 945 - Merge PR #275 from Roland van Rijswijk-Deij: Add feature to return the 946 original instead of a decrementing TTL ('serve-original-ttl') 947 - Merge PR #355 from noloader: Make ICANN Update CA and DS Trust Anchor 948 static data. 949 - Ignore cache blacklisting when trying to reply with expired data from 950 cache (#394). 951 95226 January 2021: Wouter 953 - Fix compile of unbound-dnstap-socket without dnstap installed. 954 95522 January 2021: Willem 956 - Padding of queries and responses with DNS over TLS as specified in 957 RFC7830 and RFC8467. 958 95922 January 2021: George 960 - Fix TTL of SOA record for negative answers (localzone and 961 authzone data) to be the minimum of the SOA TTL and the SOA.MINIMUM. 962 96319 January 2021: Willem 964 - Support for RFC5001: DNS Name Server Identifier (NSID) Option 965 with the nsid: option in unbound.conf 966 96718 January 2021: Wouter 968 - Fix #404: DNS query with small edns bufsize fail. 969 - Fix declaration before statement and signed comparison warning in 970 dns64. 971 97215 January 2021: Wouter 973 - Merge #402 from fobser: Implement IPv4-Embedded addresses according 974 to RFC6052. 975 97614 January 2021: Wouter 977 - Fix for #93: dynlibmodule import library is named libunbound.dll.a. 978 97913 January 2021: Wouter 980 - Merge #399 from xiangbao227: The lock of lruhash table should 981 unlocked after markdel entry. 982 - Fix for #93: dynlibmodule link fix for Windows. 983 98412 January 2021: Wouter 985 - Fix #397: [Feature request] add new type always_null to local-zone 986 similar to always_nxdomain. 987 - Fix so local zone types always_nodata and always_deny can be used 988 from the config file. 989 9908 January 2021: Wouter 991 - Merge PR #391 from fhriley: Add start_time to reply callbacks so 992 modules can compute the response time. 993 - For #391: use struct timeval* start_time for callback information. 994 - For #391: fix indentation. 995 - For #391: more double casts in python start time calculation. 996 - Add comment documentation. 997 - Fix clang analysis warning. 998 9996 January 2021: Wouter 1000 - Fix #379: zone loading over HTTP appears to have buffer issues. 1001 - Merge PR #395 from mptre: add missing null check. 1002 - Fix #387: client-subnet-always-forward seems to effectively bypass 1003 any caching? 1004 10055 January 2021: Wouter 1006 - Fix #385: autoconf 2.70 impacts unbound build 1007 - Merge PR #375 by fhriley: Add rpz_enable and rpz_disable commands 1008 to unbound-control. 1009 10104 January 2021: Wouter 1011 - For #376: Fix that comm point event is not double removed or double 1012 added to event map. 1013 - iana portlist updated. 1014 101516 December 2020: George 1016 - Fix error cases when udp-connect is set and send() returns an error 1017 (modified patch from Xin Li @delphij). 1018 101911 December 2020: Wouter 1020 - Fix #371: unbound-control timeout when Unbound is not running. 1021 - Fix to squelch permission denied and other errors from remote host, 1022 they are logged at higher verbosity but not on low verbosity. 1023 - Merge PR #335 from fobser: Sprinkle in some static to prevent 1024 missing prototype warnings. 1025 - Merge PR #373 from fobser: Warning: arithmetic on a pointer to void 1026 is a GNU extension. 1027 - Fix missing prototypes in the code. 1028 10293 December 2020: Wouter 1030 - make depend. 1031 - iana portlist updated. 1032 10332 December 2020: Wouter 1034 - Fix #360: for the additionally reported TCP Fast Open makes TCP 1035 connections fail, in that case we print a hint that this is 1036 happening with the error in the logs. 1037 - Fix #356: deadlock when listening tcp. 1038 - Fix unbound-dnstap-socket to not use log routine from interrupt 1039 handler and not print so frequently when invoked in sequence. 1040 - Fix on windows to ignore connection failure on UDP, unless verbose. 1041 - Fix for #283: fix stream reuse and tcp fast open. 1042 - Fix update, with write event check with streamreuse and fastopen. 1043 10441 December 2020: Wouter 1045 - Fix #358: Squelch udp connect 'no route to host' errors on low 1046 verbosity. 1047 104830 November 2020: Wouter 1049 - Fix assertion failure on double callback when iterator loses 1050 interest in query at head of line that then has the tcp stream 1051 not kept for reuse. 1052 - tag for the 1.13.0rc4 release. This also became the 1.13.0 1053 release version on 3 dec 2020 with the streamreuse and fastopen 1054 fix from 2 dec 2020. The code repo continues for 1.13.1 in 1055 development. 1056 105727 November 2020: Wouter 1058 - Fix compile warning for type cast in http2_submit_dns_response. 1059 - Fix when use free buffer to initialize rbtree for stream reuse. 1060 - Fix compile warnings for windows. 1061 - Fix compile warnings in rpz initialization. 1062 - Fix contrib/metrics.awk for FreeBSD awk compatibility. 1063 - tag for the 1.13.0rc3 release. 1064 106526 November 2020: Wouter 1066 - Fix to omit UDP receive errors from log, if verbosity low. 1067 These happen because of udp-connect. 1068 - For #352: contrib/metrics.awk for Prometheus style metrics output. 1069 - Fix that after failed read, the readagain cannot activate. 1070 - Clear readagain upon decommission of pending tcp structure. 1071 107225 November 2020: Wouter 1073 - with udp-connect ignore connection refused with UDP timeouts. 1074 - Fix udp-connect on FreeBSD, do send calls on connected UDP socket. 1075 - Better fix for reuse tree comparison for is-tls sockets. Where 1076 the tree key identity is preserved after cleanup of the TLS state. 1077 - Remove debug commands from reuse tests. 1078 - Fix memory leak for edns client tag opcode config element. 1079 - Attempt fix for libevent state in tcp reuse cases after a packet 1080 is written. 1081 - Fix readagain and writeagain callback functions for comm point 1082 cleanup. 1083 - tag for the 1.13.0rc2 release. 1084 108524 November 2020: Wouter 1086 - Merge PR #283 : Stream reuse. This implements upstream stream 1087 reuse for performing several queries over the same TCP or TLS 1088 channel. 1089 - set version of main branch to 1.13.0 for upcoming release. 1090 - iana portlist updated. 1091 - Fix one port unit test for udp-connect. 1092 - tag for the 1.13.0rc1 release. 1093 - Fix crash when TLS connection is closed prematurely, when 1094 reuse tree comparison is not properly identical to insertion. 1095 - Fix padding of struct regional for 32bit systems. 1096 109723 November 2020: George 1098 - Merge PR #313 from Ralph Dolmans: Replace edns-client-tag with 1099 edns-client-string option. 1100 110123 November 2020: Wouter 1102 - Merge #351 from dvzrv: Add AF_NETLINK to set of allowed socket 1103 address families. 1104 - Fix #350: with the AF_NETLINK permission, to fix 1.12.0 error: 1105 failed to list interfaces: getifaddrs: Address family not 1106 supported by protocol. 1107 - Fix #347: IP_DONTFRAG broken on Apple xcode 12.2. 1108 - Option to toggle udp-connect, default is enabled. 1109 - Fix for #303 CVE-2020-28935 : Fix that symlink does not interfere 1110 with chown of pidfile. 1111 - Further fix for it and retvalue 0 fix for it. 1112 111312 November 2020: Wouter 1114 - Fix to connect() to UDP destinations, default turned on, 1115 this lowers vulnerability to ICMP side channels. 1116 - Retry for interfaces with unused ports if possible. 1117 111810 November 2020: Wouter 1119 - Fix #341: fixing a possible memory leak. 1120 - Fix memory leak after fix for possible memory leak failure. 1121 - Fix #343: Fail to build --with-libnghttp2 with error: 'SSIZE_MAX' 1122 undeclared. 1123 112427 October 2020: Wouter 1125 - In man page note that tls-cert-bundle is read before permission 1126 drop and chroot. 1127 112822 October 2020: Wouter 1129 - Fix #333: Unbound Segmentation Fault w/ log_info Functions From 1130 Python Mod. 1131 - Fix that minimal-responses does not remove addresses from a priming 1132 query response. 1133 113421 October 2020: George 1135 - Fix #327: net/if.h check fails on some darwin versions; contribution by 1136 Joshua Root. 1137 - Fix #320: potential memory corruption due to size miscomputation upton 1138 custom region alloc init. 1139 114021 October 2020: Wouter 1141 - Merge PR #228 : infra-keep-probing option to probe hosts that are 1142 down. Add infra-keep-probing: yes option. Hosts that are down are 1143 probed more frequently. 1144 With the option turned on, it probes about every 120 seconds, 1145 eventually after exponential backoff, and that keeps that way. If 1146 traffic keeps up for the domain. It probes with one at a time, eg. 1147 one query is allowed to probe, other queries within that 120 second 1148 interval are turned away. 1149 115019 October 2020: George 1151 - Merge PR #324 from James Renken: Add modern X.509v3 extensions to 1152 unbound-control TLS certificates. 1153 - Fix for PR #324 to attach the x509v3 extensions to the client 1154 certificate. 1155 115619 October 2020: Ralph 1157 - local-zone regional allocations outside of chunk 1158 115919 October 2020: Wouter 1160 - Fix that http settings have colon in set_option, for 1161 http-endpoint, http-max-streams, http-query-buffer-size, 1162 http-response-buffer-size, and http-nodelay. 1163 - Fix memory leak of https port string when reading config. 1164 - Fix #330: [Feature request] Add unencrypted DNS over HTTPS support. 1165 This adds the option http-notls-downstream: yesno to change that, 1166 and the dohclient test code has the -n option. 1167 - Fix python documentation warning on functions.rst inplace_cb_reply. 1168 - Fix dnstap test to wait for log timer to see if queries are logged. 1169 - Log ip address when http session recv fails, eg. due to tls fail. 1170 - Fix to set the tcp handler event toggle flag back to default when 1171 the handler structure is reused. 1172 - Clean the fix for out of order TCP processing limits on number 1173 of queries. It was tested to work. 1174 117516 October 2020: Wouter 1176 - Fix that the out of order TCP processing does not limit the 1177 number of outstanding queries over a connection. 1178 117915 October 2020: George 1180 - Fix that if there are reply callbacks for the given rcode, those 1181 are called per reply and a new message created if that was modified 1182 by the call. 1183 - Pass the comm_reply information to the inplace_cb_reply* functions 1184 during the mesh state and update the documentation on that. 1185 118615 October 2020: Wouter 1187 - Merge PR #326 from netblue30: DoH: implement content-length 1188 header field 1189 - DoH content length, simplify code, remove declaration after 1190 statement and fix cast warning. 1191 119214 October 2020: Wouter 1193 - Fix for python reply callback to see mesh state reply_list member, 1194 it only removes it briefly for the commpoint call so that it does 1195 not drop it and attempt to modify the reply list during reply. 1196 - Fix that if there are on reply callbacks, those are called per 1197 reply and a new message created if that was modified by the call. 1198 - Free up auth zone parse region after use for lookup of host 1199 120013 October 2020: Wouter 1201 - Fix #323: unbound testsuite fails on mock build in systemd-nspawn 1202 if systemd support is build. 1203 12049 October 2020: Wouter 1205 - Fix dnstap socket and the chroot not applied properly to the dnstap 1206 socket path. 1207 - Fix warning in libnss compile, nss_buf2dsa is not used without DSA. 1208 12098 October 2020: Wouter 1210 - Tag for 1.12.0 release. 1211 - Current repo is version 1.12.1 in development. 1212 - Fix #319: potential memory leak on config failure, in rpz config. 1213 12141 October 2020: Wouter 1215 - Current repo is version 1.12.0 for release. Tag for 1.12.0rc1. 1216 121730 September 2020: Wouter 1218 - Fix doh tests when not compiled in. 1219 - Add dohclient test executable to gitignore. 1220 - Fix stream_ssl, ssl_req_order and ssl_req_timeout tests for 1221 alloc check debug output. 1222 - Easier kill of unbound-dnstap-socket tool in test. 1223 - Fix memory leak of edns tags at libunbound context delete. 1224 - Fix double loopexit for unbound-dnstap-socket after sigterm. 1225 122629 September 2020: Ralph 1227 - DNS Flag Day 2020: change edns-buffer-size default to 1232. 1228 122928 September 2020: Wouter 1230 - Fix unit test for dnstap changes, so that it waits for the timer. 1231 123223 September 2020: Wouter 1233 - Fix #305: dnstap logging significantly affects unbound performance 1234 (regression in 1.11). 1235 - Fix #305: only wake up thread when threshold reached. 1236 - Fix to ifdef fptr wlist item for dnstap. 1237 123823 September 2020: Ralph 1239 - Fix edns-client-tags get_option typo 1240 - Add edns-client-tag-opcode option 1241 - Use inclusive language in configuration 1242 124321 September 2020: Ralph 1244 - Fix #304: dnstap logging not recovering after dnstap process restarts 1245 124621 September 2020: Wouter 1247 - Merge PR #311 by luismerino: Dynlibmod leak. 1248 - Error message is logged for dynlibmod malloc failures. 1249 - iana portlist updated. 1250 125118 September 2020: Wouter 1252 - Fix that prefer-ip4 and prefer-ip6 can be get and set with 1253 unbound-control, with libunbound and the unbound-checkconf option 1254 output function. 1255 - iana portlist updated. 1256 125715 September 2020: George 1258 - Introduce test for statistics. 1259 126015 September 2020: Wouter 1261 - Spelling fix. 1262 126311 September 2020: Wouter 1264 - Remove x file mode on ipset/ipset.c and h files. 1265 12669 September 2020: Wouter 1267 - Fix num.expired statistics output. 1268 126931 August 2020: Wouter 1270 - Merge PR #293: Add missing prototype. Also refactor to use the new 1271 shorthand function to clean up the code. 1272 - Refactor to use sock_strerr shorthand function. 1273 - Fix #296: systemd nss-lookup.target is reached before unbound can 1274 successfully answer queries. Changed contrib/unbound.service.in. 1275 127627 August 2020: Wouter 1277 - Similar to NSD PR#113, implement that interface names can be used, 1278 eg. something like interface: eth0 is resolved at server start and 1279 uses the IP addresses for that named interface. 1280 - Review fix, doxygen and assign null in case of error free. 1281 128226 August 2020: George 1283 - Update documentation in python example code. 1284 128524 August 2020: Wouter 1286 - Fix that dnstap reconnects do not spam the log with the repeated 1287 attempts. Attempts on the timer are only logged on high verbosity, 1288 if they produce a connection failure error. 1289 - Fix to apply chroot to dnstap-socket-path, if chroot is enabled. 1290 - Change configure to use EVP_sha256 instead of HMAC_Update for 1291 openssl-3.0.0. 1292 129320 August 2020: Ralph 1294 - Fix stats double count issue (#289). 1295 129613 August 2020: Ralph 1297 - Create and init edns tags data for libunbound. 1298 129910 August 2020: Ralph 1300 - Merge (modified) PR #277, use EVP_MAC_CTX_set_params if available, 1301 by Vítězslav Čížek. 1302 130310 August 2020: Wouter 1304 - Fix #287: doc typo: "Additionaly". 1305 - Rerun autoconf 1306 13076 August 2020: Wouter 1308 - Merge PR #284 and Fix #246: Remove DLV entirely from Unbound. 1309 The DLV has been decommisioned and in unbound 1.5.4, in 2015, there 1310 was advise to stop using it. The current code base does not contain 1311 DLV code any more. The use of dlv options displays a warning. 1312 13135 August 2020: Wouter 1314 - contrib/aaaa-filter-iterator.patch file renewed diff content to 1315 apply cleanly to the current coderepo for the current code version. 1316 13175 August 2020: Ralph 1318 - Merge PR #272: Add EDNS client tag functionality. 1319 13204 August 2020: George 1321 - Improve error log message when inserting rpz RR. 1322 - Merge PR #280, Make tvOS & watchOS checks verify truthiness as well as 1323 definedness, by Felipe Gasper. 1324 13254 August 2020: Wouter 1326 - Fix mini_event.h on OpenBSD cannot find fd_set. 1327 132831 July 2020: Wouter 1329 - Fix doxygen comment for no ssl for tls session ticket key callback 1330 routine. 1331 133227 July 2020: George 1333 - Merge PR #268, draft-ietf-dnsop-serve-stale-10 has become RFC 8767 on 1334 March 2020, by and0x000. 1335 133627 July 2020: Ralph 1337 - Merge PR #269, Fix python module len() implementations, by Torbjörn 1338 Lönnemark 1339 134027 July 2020: Wouter 1341 - branch now named 1.11.1. 1.11.0rc1 became the 1.11.0 release. 1342 - Merge PR #270 from cgzones: munin plugin: always exit 0 in autoconf 1343 134420 July 2020: Wouter 1345 - Fix streamtcp to print packet data to stdout. This makes the 1346 stdout and stderr not mix together lines, when parsing its output. 1347 - Fix contrib/fastrpz.patch to apply cleanly. It fixes for changes 1348 due to added libdynmod, but it does not compile, it conflicts with 1349 new rpz code. 1350 - branch now named 1.11.0 and 1.11.0rc1 tag. 1351 135217 July 2020: Wouter 1353 - Fix libnettle compile for session ticket key callback function 1354 changes. 1355 - Fix lock dependency cycle in rpz zone config setup. 1356 135717 July 2020: Ralph 1358 - Merge PR #234 - Ensure proper alignment of cmsg buffers by Jérémie 1359 Courrèges-Anglas. 1360 - Fix PR #234 log_assert sizeof to use union buffer. 1361 136216 July 2020: Wouter 1363 - Fix check conf test for referencing installation paths. 1364 - Fix unused variable warning for clang analyzer. 1365 136616 July 2020: George 1367 - Introduce 'include-toplevel:' configuration option. 1368 136916 July 2020: Ralph 1370 - Add bidirectional frame streams support. 1371 13728 July 2020: Wouter 1373 - Fix add missing DSA header, for compilation without deprecated 1374 OpenSSL APIs. 1375 - Fix to use SSL_CTX_set_tlsext_ticket_key_evp_cb in OpenSSL 1376 3.0.0-alpha4. 1377 - Longer keys for the test set, this avoids weak crypto errors. 1378 13797 July 2020: Wouter 1380 - Fix #259: Fix unbound-checkconf does not check view existence. 1381 unbound-checkconf checks access-control-view, access-control-tags, 1382 access-control-tag-actions and access-control-tag-datas. 1383 - Fix offset of error printout for access-control-tag-datas. 1384 - Review fixes for checkconf #259 change. 1385 13866 July 2020: Wouter 1387 - run_vm cleanup better and removes trailing slash on single argument. 1388 138929 June 2020: Wouter 1390 - Move reply list clean for serve expired mesh callback to after 1391 the reply is sent, so that script callbacks have reply_info. 1392 - Also move reply list clean for mesh callbacks to the scrip callback 1393 can see the reply_info. 1394 - Fix for mesh accounting if the reply list already empty to begin 1395 with. 1396 - Fix for mesh accounting when rpz decides to drop a reply with a 1397 tcp stream waiting for it. 1398 - Review fix for number of detached states due to use of variable 1399 after end of loop. 1400 - Fix tcp req info drop due to size call into mesh accounting 1401 removal of mesh state during mesh send reply. 1402 140324 June 2020: Wouter 1404 - iana portlist updated. 1405 - doxygen file comments for dynlibmodule. 1406 140717 June 2020: Wouter 1408 - Fix default explanation in man page for qname-minimisation-strict. 1409 - Fix display of event loop method with libev. 1410 14118 June 2020: Wouter 1412 - Mention tls name possible when tls is enabled for stub-addr in the 1413 man page. 1414 141527 May 2020: George 1416 - Merge PR #241 by Robert Edmonds: contrib/libunbound.pc.in: Do not use 1417 "Requires:". 1418 141925 May 2020: George 1420 - Update contrib/aaaa-filter-iterator.patch for the recent 1421 generate_sub_request() change and to apply cleanly. 1422 142321 May 2020: George 1424 - Fix for integer overflow when printing RDF_TYPE_TIME. 1425 142619 May 2020: Wouter 1427 - CVE-2020-12662 Unbound can be tricked into amplifying an incoming 1428 query into a large number of queries directed to a target. 1429 - CVE-2020-12663 Malformed answers from upstream name servers can be 1430 used to make Unbound unresponsive. 1431 - Release 1.10.1 is 1.10.0 with fixes, code repository continues, 1432 including those fixes, towards the next release. Configure has 1433 version 1.10.2 version number in it. 1434 - For PR #93: windows compile warnings removal 1435 - windows compile warnings removal for ip dscp option code. 1436 - For PR #93: unit test for dynlib module. 1437 143818 May 2020: Wouter 1439 - For PR #93: dynlibmod can handle reloads and deinit and inits again, 1440 with dlclose and dlopen of the library again. Also for multiple 1441 modules. Fix memory leak by not closing dlopened content. Fix 1442 to allow one dynlibmod instance by unbound-checkconf. 1443 - For PR #93: checkconf allows multiple dynlib in module-config, for 1444 a couple cases. 1445 - For PR #93: checkconf allows python dynlib in module-config, for 1446 a couple cases. 1447 - For PR #93: man page spelling reference fix. 1448 - For PR #93: fix link of other executables for dynlibmod dependency. 1449 145015 May 2020: Wouter 1451 - Merge PR #93: Add dynamic library support. 1452 - Fixed conflicts for PR #93 and make configure, yacc, lex. 1453 - For PR #93: Fix warnings for dynlibmodule. 1454 145515 May 2020: Ralph 1456 - Cache ECS answers with longest scope of CNAME chain. 1457 145822 April 2020: George 1459 - Explicitly use 'rrset-roundrobin: no' for test cases. 1460 146121 April 2020: Wouter 1462 - Merge #225 from akhait: KSK-2010 has been revoked. It removes the 1463 KSK-2010 from the default list in unbound-anchor, now that the 1464 revocation period is over. KSK-2017 is the only trust anchor in 1465 the shipped default now. 1466 146721 April 2020: George 1468 - Change default value for 'rrset-roundrobin' to yes. 1469 - Fix tests for new rrset-roundrobin default. 1470 147120 April 2020: Wouter 1472 - Fix #222: --enable-rpath, fails to rpath python lib. 1473 - Fix for count of reply states in the mesh. 1474 - Remove unneeded was_mesh_reply check. 1475 147617 April 2020: George 1477 - Add SNI support on more TLS connections (fixes #193). 1478 - Add SNI support to unbound-anchor. 1479 148016 April 2020: George 1481 - Add doxygen documentation for DSCP. 1482 148316 April 2020: Wouter 1484 - Fix help return code in unbound-control-setup script. 1485 - Fix for posix shell syntax for trap in nsd-control-setup. 1486 - Fix for posix shell syntax for trap in run_msg.sh test script. 1487 148815 April 2020: George 1489 - Fix #220: auth-zone section in config may lead to segfault. 1490 14917 April 2020: Wouter 1492 - Merge PR #214 from gearnode: unbound-control-setup recreate 1493 certificates. With the -r option the certificates are created 1494 again, without it, only the files that do not exist are created. 1495 14966 April 2020: Ralph 1497 - Keep track of number of timeouts. Use this counter to determine if 1498 capsforid fallback should be started. 1499 15006 April 2020: George 1501 - More documentation for redis-expire-records option. 1502 15031 April 2020: George 1504 - Merge PR #206: Redis TTL, by Talkabout. 1505 150630 March 2020: Wouter 1507 - Merge PR #207: Clarify if-automatic listens on 0.0.0.0 and :: 1508 - Merge PR #208: Fix uncached CLIENT_RESPONSE'es on stateful 1509 transports. 1510 151127 March 2020: Wouter 1512 - Merge PR #203 from noloader: Update README-Travis.md with current 1513 procedures. 1514 151527 March 2020: Ralph 1516 - Make unbound-control error returned on missing domain name more user 1517 friendly. 1518 151926 March 2020: Ralph 1520 - Fix RPZ concurrency issue when using auth_zone_reload. 1521 152225 March 2020: George 1523 - Merge PR #201 from noloader: Fix OpenSSL cross-compaile warnings. 1524 - Fix on #201. 1525 152624 March 2020: Wouter 1527 - Merge PR #200 from yarikk: add ip-dscp option to specify the DSCP 1528 tag for outgoing packets. 1529 - Fixes on #200. 1530 - Travis fix for ios by omitting tools from install. 1531 153223 March 2020: Wouter 1533 - Fix compile on Solaris for unbound-checkconf. 1534 153520 March 2020: George 1536 - Merge PR #198 from fobser: Declare lz_enter_rr_into_zone() static, it's 1537 only used in this file. 1538 153920 March 2020: Wouter 1540 - Merge PR #197 from fobser: Make log_ident_revert_to_default() a 1541 proper prototype. 1542 154319 March 2020: Ralph 1544 - Merge PR#191: Update iOS testing on Travis, by Jeffrey Walton. 1545 - Fix #158: open tls-session-ticket-keys as binary, for Windows. By 1546 Daisuke HIGASHI. 1547 - Merge PR#134, Allow the kernel to provide random source ports. By 1548 Florian Obser. 1549 - Log warning when using outgoing-port-permit and outgoing-port-avoid 1550 while explicit port randomisation is disabled. 1551 - Merge PR#194: Add libevent testing to Travis, by Jeffrey Walton. 1552 - Fix .travis.yml error, missing 'env' option. 1553 155416 March 2020: Wouter 1555 - Fix #192: In the unbound-checkconf tool, the module config of 1556 dns64 subnetcache respip validator iterator is whitelisted, it was 1557 reported it seems to work. 1558 155912 March 2020: Wouter 1560 - Fix compile of test tools without protobuf. 1561 156211 March 2020: Ralph 1563 - Add check to make sure RPZ records are subdomains of configured 1564 zone origin. 1565 156611 March 2020: George 1567 - Fix #189: mini_event.h:142:17: error: field 'ev_timeout' has incomplete 1568 type, by noloader. 1569 - Changelog entry for (Fix #189, Merge PR #190). 1570 157111 March 2020: Wouter 1572 - Fix #188: unbound-control.c:882:6: error: 'execlp' is 1573 unavailable: not available on tvOS. 1574 15756 March 2020: George 1576 - Merge PR #186, fix #183: Fix unrecognized 'echo -n' option on OS X, by 1577 noloader 1578 15795 March 2020: Wouter 1580 - Fix PR #182 from noloader: Add iOS testing to Travis. 1581 15824 March 2020: Ralph 1583 - Update README-Travis.md (from PR #179), by Jeffrey Walton. 1584 15854 March 2020: George 1586 - Merge PR #181 from noloader: Fix OpenSSL -pie warning on Android. 1587 15884 March 2020: Wouter 1589 - Merge PR #180 from noloader: Avoid calling exit in Travis script. 1590 15913 March 2020: George 1592 - Upgrade config.guess(2020-01-01) and config.sub(2020-01-01). 1593 15942 March 2020: Ralph 1595 - Fix #175, Merge PR #176: fix link error when OpenSSL is configured 1596 with no-engine, thanks noloader. 1597 15982 March 2020: George 1599 - Fix compiler warning in dns64/dns64.c 1600 - Merge PR #174: Add Android to Travis testing, by noloader. 1601 - Move android build scripts to contrib/ and allow android tests to fail. 1602 16032 March 2020: Wouter 1604 - Fix #177: dnstap does not build on macOS. 1605 160628 February 2020: Ralph 1607 - Merge PR #172: Add IBM s390x arch for testing, by noloader. 1608 160928 February 2020: Wouter 1610 - Merge PR #173: updated makedist.sh for config.guess and 1611 config.sub and sha256 digest for gpg, by noloader. 1612 - Merge PR #164: Framestreams, this branch implements dnstap 1613 unidirectional connectivity in unbound. This has a number of 1614 new features. 1615 1616 The dependency on libfstrm is removed. The fstrm protocol code 1617 resides in dnstap/dnstap_fstrm.h and dnstap/dnstap_fstrm.c. This 1618 contains a brief definition of what unbound needs. 1619 1620 The make unbound-dnstap-socket builds a debug tool, 1621 unbound-dnstap-socket. It can listen, accept multiple DNSTAP 1622 streams and print information. Commandline options control it. 1623 1624 Unbound can reconnect if the unix domain socket file socket is 1625 closed. This uses exponential backoff after which it uses a 1626 one second timer to throttle cpu down. There is also support 1627 to use TCP and TLS for connecting to the log server. There 1628 are new config options to turn them on, in the dnstap section 1629 in the man page and example config file. dnstap-ip with IP 1630 address of server for TCP or TLS use. dnstap-tls to turn 1631 on TLS. And dnstap-tls-server-name, dnstap-tls-cert-bundle, 1632 dnstap-tls-client-key-file and dnstap-tls-client-cert-file 1633 to configure the certificates for server authentication and 1634 client authentication, or leave at "" to not use that. 1635 163627 February 2020: George 1637 - Merge PR #171: Add additional compilers and platforms to Travis 1638 testing, by noloader. 1639 164027 February 2020: Wouter 1641 - Fix #169: Fix warning for daemon/remote.c output may be truncated 1642 from snprintf. 1643 - Fix #170: Fix gcc undefined sanitizer signed integer overflow 1644 warning in signature expiry RFC1982 serial number arithmetic. 1645 - Fix more undefined sanitizer issues, in respip copy_rrset null 1646 dname, and in the client_info_compare routine for null memcmp. 1647 164826 February 2020: Wouter 1649 - iana portlist updated. 1650 165125 February 2020: Wouter 1652 - Fix #165: Add prefer-ip4: yesno config option to prefer ipv4 for 1653 using ipv4 filters, because the hosts ip6 netblock /64 is not owned 1654 by one operator, and thus reputation is shared. 1655 165624 February 2020: George 1657 - Merge PR #166: Fix typo in unbound.service.in, by glitsj16. 1658 165920 February 2020: Wouter 1660 - Updated contrib/unbound_smf23.tar.gz with Solaris SMF service for 1661 Unbound from Yuri Voinov. 1662 - master branch has 1.10.1 version. 1663 166418 February 2020: Wouter 1665 - protect X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS with ifdef for 1666 different openssl versions. 1667 166817 February 2020: Wouter 1669 - changelog point where the tag for 1.10.0rc2 release is. And with 1670 the unbound_smf23 commit added to it, that is the 1.10.0 release. 1671 167217 February 2020: Ralph 1673 - Add respip to supported module-config options in unbound-checkconf. 1674 167517 February 2020: George 1676 - Remove unused variable. 1677 167817 February 2020: Wouter 1679 - contrib/drop2rpz: perl script that converts the Spamhaus DROP-List 1680 in RPZ-Format, contributed by Andreas Schulze. 1681 168214 February 2020: Wouter 1683 - Fix spelling in unbound.conf.5.in. 1684 - Stop unbound-checkconf from insisting that auth-zone and rpz 1685 zonefiles have to exist. They can not exist, and download later. 1686 168713 February 2020: Wouter 1688 - tag for 1.10.0rc1 release. 1689 169012 February 2020: Wouter 1691 - Fix with libnettle make test with dsa disabled. 1692 - Fix contrib/fastrpz.patch to apply cleanly. Fix for serve-stale 1693 fixes, but it does not compile, conflicts with new rpz code. 1694 - Fix to clean memory leak of respip_addr.lock when ip_tree deleted. 1695 - Fix compile warning when threads disabled. 1696 - updated version number to 1.10.0. 1697 169810 February 2020: George 1699 - Document 'ub_result.was_ratelimited' in libunbound. 1700 - Fix use after free on log-identity after a reload; Fixes #163. 1701 17026 February 2020: George 1703 - Fix num_reply_states and num_detached_states counting with 1704 serve_expired_callback. 1705 - Cleaner code in mesh_serve_expired_lookup. 1706 - Document in unbound.conf manpage that configuration clauses can be 1707 repeated in the configuration file. 1708 17096 February 2020: Wouter 1710 - Fix num_reply_addr counting in mesh and tcp drop due to size 1711 after serve_stale commit. 1712 - Fix to create and destroy rpz_lock in auth_zones structure. 1713 - Fix to lock zone before adding rpz qname trigger. 1714 - Fix to lock and release once in mesh_serve_expired_lookup. 1715 - Fix to put braces around empty if body when threading is disabled. 1716 17175 February 2020: George 1718 - Added serve-stale functionality as described in 1719 draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used 1720 to configure the behavior. 1721 - Updated cachedb to honor `serve-expired-ttl`; Fixes #107. 1722 - Renamed statistic `num.zero_ttl` to `num.expired` as expired replies 1723 come with a configurable TTL value (`serve-expired-reply-ttl`). 1724 - Fixed stats when replying with cached, cname-aliased records. 1725 - Added missing default values for redis cachedb backend. 1726 17273 February 2020: Ralph 1728 - Add assertion to please static analyzer 1729 173031 January 2020: Wouter 1731 - Fix fclose on error in TLS session ticket code. 1732 173330 January 2020: Ralph 1734 - Fix memory leak in error condition remote.c 1735 - Fix double free in error condition view.c 1736 - Fix memory leak in do_auth_zone_transfer on success 1737 - Merge RPZ support into master. Only QNAME and Response IP triggers are 1738 supported. 1739 - Stop working on socket when socket() call returns an error. 1740 - Check malloc return values in TLS session ticket code 1741 174230 January 2020: Wouter 1743 - Fix subnet tests for disabled DSA algorithm by default. 1744 - Update contrib/fastrpz.patch for clean diff with current code. 1745 - Merge PR#151: Fixes for systemd units, by Maryse47, Edmonds 1746 and Frzk. Updates the unbound.service systemd file and adds 1747 a portable systemd service file. 1748 - updated .gitignore for added contrib file. 1749 - Add build rule for ipset to Makefile 1750 - Add getentropy_freebsd.o to Makefile dependencies. 1751 175229 January 2020: Ralph 1753 - Merge PR#156 from Alexander Berkes; Added unbound-control 1754 view_local_datas_remove command. 1755 175629 January 2020: Wouter 1757 - Fix #157: undefined reference to `htobe64'. 1758 175928 January 2020: Ralph 1760 - Merge PR#147; change rfc reference for reserved top level dns names. 1761 176228 January 2020: Wouter 1763 - iana portlist updated. 1764 - Fix to silence the tls handshake errors for broken pipe and reset 1765 by peer, unless verbosity is set to 2 or higher. 1766 176727 January 2020: Ralph 1768 - Merge PR#154; Allow use of libbsd functions with configure option 1769 --with-libbsd. By Robert Edmonds and Steven Chamberlain. 1770 - Merge PR#148; Add some TLS stats to unbound_munin_. By Fredrik Pettai. 1771 177227 January 2020: Wouter 1773 - Merge PR#155 from Robert Edmonds: contrib/libunbound.pc.in: Fixes 1774 to Libs/Requires for crypto library dependencies. 1775 - Fix #153: Disable validation for DSA algorithms. RFC 8624 1776 compliance. 1777 177823 January 2020: Wouter 1779 - Merge PR#150 from Frzk: Systemd unit without chroot. It add 1780 contrib/unbound_nochroot.service.in, a systemd file for use with 1781 chroot: "", see comments in the file, it uses systemd protections 1782 instead. 1783 178414 January 2020: Wouter 1785 - Removed the dnscrypt_queries and dnscrypt_queries_chacha tests, 1786 because dnscrypt-proxy (2.0.36) does not support the test setup 1787 any more, and also the config file format does not seem to have 1788 the appropriate keys to recreate that setup. 1789 - Fix crash after reload where a stats lookup could reference old key 1790 cache and neg cache structures. 1791 - Fix for memory leak when edns subnet config options are read when 1792 compiled without edns subnet support. 1793 - Fix auth zone support for NSEC3 records without salt. 1794 179510 January 2020: Wouter 1796 - Fix the relationship between serve-expired and prefetch options, 1797 patch from Saksham Manchanda from Secure64. 1798 - Fix unreachable code in ssl set options code. 1799 18008 January 2020: Ralph 1801 - Fix #138: stop binding pidfile inside chroot dir in systemd service 1802 file. 1803 18048 January 2020: Wouter 1805 - Fix 'make test' to work for --disable-sha1 configure option. 1806 - Fix out-of-bounds null-byte write in sldns_bget_token_par while 1807 parsing type WKS, reported by Luis Merino from X41 D-Sec. 1808 - Updated sldns_bget_token_par fix for also space for the zero 1809 delimiter after the character. And update for more spare space. 1810 18116 January 2020: George 1812 - Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD. 1813 The dl_iterate_phdr() function introduced in newer versions raises 1814 compilation errors on solaris 10. 1815 - Changes to compat/getentropy_solaris.c for, 1816 ifdef stdint.h inclusion for older systems. 1817 ifdef sha2.h inclusion for older systems. 1818 18196 January 2020: Wouter 1820 - Merge #135 from Florian Obser: Use passed in neg and key cache 1821 if non-NULL. 1822 - Fix #140: Document slave not downloading new zonefile upon update. 1823 182416 December 2019: George 1825 - Update mailing list URL. 1826 182712 December 2019: Ralph 1828 - Master is 1.9.7 in development. 1829 - Fix typo to let serve-expired-ttl work with ub_ctx_set_option(), by 1830 Florian Obser 1831 183210 December 2019: Wouter 1833 - Fix to make auth zone IXFR to fallback to AXFR if a single 1834 response RR is received over TCP with the SOA in it. 1835 18366 December 2019: Wouter 1837 - Fix ipsecmod compile. 1838 - Fix Makefile.in for ipset module compile, from Adi Prasaja. 1839 - release-1.9.6 tag, which became the 1.9.6 release 1840 18415 December 2019: Wouter 1842 - unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1 1843 replacements for unbound-fuzzme.c that gets created after applying 1844 the contrib/unbound-fuzzme.patch. They are contributed by 1845 Eric Sesterhenn from X41 D-Sec. 1846 - tag for 1.9.6rc1. 1847 18484 December 2019: Wouter 1849 - Fix lock type for memory purify log lock deletion. 1850 - Fix testbound for alloccheck runs, memory purify and lock checks. 1851 - update contrib/fastrpz.patch to apply more cleanly. 1852 - Fix Make Test Fails when Configured With --enable-alloc-nonregional, 1853 reported by X41 D-Sec. 1854 18553 December 2019: Wouter 1856 - Merge pull request #124 from rmetrich: Changed log lock 1857 from 'quick' to 'basic' because this is an I/O lock. 1858 - Fix text around serial arithmatic used for RRSIG times to refer 1859 to correct RFC number. 1860 - Fix Assert Causing DoS in synth_cname(), 1861 reported by X41 D-Sec. 1862 - Fix similar code in auth_zone synth cname to add the extra checks. 1863 - Fix Assert Causing DoS in dname_pkt_copy(), 1864 reported by X41 D-Sec. 1865 - Fix OOB Read in sldns_wire2str_dname_scan(), 1866 reported by X41 D-Sec. 1867 - Fix Out of Bounds Write in sldns_str2wire_str_buf(), 1868 reported by X41 D-Sec. 1869 - Fix Out of Bounds Write in sldns_b64_pton(), 1870 fixed by check in sldns_str2wire_int16_data_buf(), 1871 reported by X41 D-Sec. 1872 - Fix Insufficient Handling of Compressed Names in dname_pkt_copy(), 1873 reported by X41 D-Sec. 1874 - Fix Out of Bound Write Compressed Names in rdata_copy(), 1875 reported by X41 D-Sec. 1876 - Fix Hang in sldns_wire2str_pkt_scan(), 1877 reported by X41 D-Sec. 1878 This further lowers the max to 256. 1879 - Fix snprintf() supports the n-specifier, 1880 reported by X41 D-Sec. 1881 - Fix Bad Indentation, in dnscrypt.c, 1882 reported by X41 D-Sec. 1883 - Fix Client NONCE Generation used for Server NONCE, 1884 reported by X41 D-Sec. 1885 - Fix compile error in dnscrypt. 1886 - Fix _vfixed not Used, removed from sbuffer code, 1887 reported by X41 D-Sec. 1888 - Fix Hardcoded Constant, reported by X41 D-Sec. 1889 - make depend 1890 18912 December 2019: Wouter 1892 - Merge pull request #122 from he32: In tcp_callback_writer(), 1893 don't disable time-out when changing to read. 1894 189522 November 2019: George 1896 - Fix compiler warnings. 1897 189822 November 2019: Wouter 1899 - Fix dname loop maximum, reported by Eric Sesterhenn from X41 D-Sec. 1900 - Add make distclean that removes everything configure produced, 1901 and make maintainer-clean that removes bison and flex output. 1902 190320 November 2019: Wouter 1904 - Fix Out of Bounds Read in rrinternal_get_owner(), 1905 reported by X41 D-Sec. 1906 - Fix Race Condition in autr_tp_create(), 1907 reported by X41 D-Sec. 1908 - Fix Shared Memory World Writeable, 1909 reported by X41 D-Sec. 1910 - Adjust unbound-control to make stats_shm a read only operation. 1911 - Fix Weak Entropy Used For Nettle, 1912 reported by X41 D-Sec. 1913 - Fix Randomness Error not Handled Properly, 1914 reported by X41 D-Sec. 1915 - Fix Out-of-Bounds Read in dname_valid(), 1916 reported by X41 D-Sec. 1917 - Fix Config Injection in create_unbound_ad_servers.sh, 1918 reported by X41 D-Sec. 1919 - Fix Local Memory Leak in cachedb_init(), 1920 reported by X41 D-Sec. 1921 - Fix Integer Underflow in Regional Allocator, 1922 reported by X41 D-Sec. 1923 - Upgrade compat/getentropy_linux.c to version 1.46 from OpenBSD. 1924 - Synchronize compat/getentropy_win.c with version 1.5 from 1925 OpenBSD, no changes but makes the file, comments, identical. 1926 - Upgrade compat/getentropy_solaris.c to version 1.13 from OpenBSD. 1927 - Upgrade compat/getentropy_osx.c to version 1.12 from OpenBSD. 1928 - Changes to compat/getentropy files for, 1929 no link to openssl if using nettle, and hence config.h for 1930 HAVE_NETTLE variable. 1931 compat definition of MAP_ANON, for older systems. 1932 ifdef stdint.h inclusion for older systems. 1933 ifdef sha2.h inclusion for older systems. 1934 - Fixed Compat Code Diverging from Upstream, reported by X41 D-Sec. 1935 - Fix compile with --enable-alloc-checks, reported by X41 D-Sec. 1936 - Fix Terminating Quotes not Written, reported by X41 D-Sec. 1937 - Fix Useless memset() in validator, reported by X41 D-Sec. 1938 - Fix Unrequired Checks, reported by X41 D-Sec. 1939 - Fix Enum Name not Used, reported by X41 D-Sec. 1940 - Fix NULL Pointer Dereference via Control Port, 1941 reported by X41 D-Sec. 1942 - Fix Bad Randomness in Seed, reported by X41 D-Sec. 1943 - Fix python examples/calc.py for eval, reported by X41 D-Sec. 1944 - Fix comments for doxygen in dns64. 1945 194619 November 2019: Wouter 1947 - Fix CVE-2019-18934, shell execution in ipsecmod. 1948 - 1.9.5 is 1.9.4 with bugfix, trunk is 1.9.6 in development. 1949 - Fix authzone printout buffer length check. 1950 - Fixes to please lint checks. 1951 - Fix Integer Overflow in Regional Allocator, 1952 reported by X41 D-Sec. 1953 - Fix Unchecked NULL Pointer in dns64_inform_super() 1954 and ipsecmod_new(), reported by X41 D-Sec. 1955 - Fix Out-of-bounds Read in rr_comment_dnskey(), 1956 reported by X41 D-Sec. 1957 - Fix Integer Overflows in Size Calculations, 1958 reported by X41 D-Sec. 1959 - Fix Integer Overflow to Buffer Overflow in 1960 sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec. 1961 - Fix Out of Bounds Read in sldns_str2wire_dname(), 1962 reported by X41 D-Sec. 1963 - Fix Out of Bounds Write in sldns_bget_token_par(), 1964 reported by X41 D-Sec. 1965 196618 November 2019: Wouter 1967 - In unbound-host use separate variable for get_option to please 1968 code checkers. 1969 - update to bison output of 3.4.1 in code repository. 1970 - Provide a prototype for compat malloc to remove compile warning. 1971 - Portable grep usage for reuseport configure test. 1972 - Check return type of HMAC_Init_ex for openssl 0.9.8. 1973 - gitignore .source tempfile used for compatible make. 1974 197513 November 2019: Wouter 1976 - iana portlist updated. 1977 - contrib/fastrpz.patch updated to apply for current code. 1978 - fixes for splint cleanliness, long vs int in SSL set_mode. 1979 198011 November 2019: Wouter 1981 - Fix #109: check number of arguments for stdin-pipes in 1982 unbound-control and fail if too many arguments. 1983 - Merge #102 from jrtc27: Add getentropy emulation for FreeBSD. 1984 198524 October 2019: Wouter 1986 - Fix #99: Memory leak in ub_ctx (event_base will never be freed). 1987 198823 October 2019: George 1989 - Add new configure option `--enable-fully-static` to enable full static 1990 build if requested; in relation to #91. 1991 199223 October 2019: Wouter 1993 - Merge #97: manpage: Add missing word on unbound.conf, 1994 from Erethon. 1995 199622 October 2019: Wouter 1997 - drop-tld.diff: adds option drop-tld: yesno that drops 2 label 1998 queries, to stop random floods. Apply with 1999 patch -p1 < contrib/drop-tld.diff and compile. 2000 From Saksham Manchanda (Secure64). Please note that we think this 2001 will drop DNSKEY and DS lookups for tlds and hence break DNSSEC 2002 lookups for downstream clients. 2003 20047 October 2019: Wouter 2005 - Add doxygen comments to unbound-anchor source address code, in #86. 2006 20073 October 2019: Wouter 2008 - Merge #90 from vcunat: fix build with nettle-3.5. 2009 - Merge 1.9.4 release with fix for vulnerability CVE-2019-16866. 2010 - Continue with development of 1.9.5. 2011 - Merge #86 from psquarejho: Added -b source address option to 2012 smallapp/unbound-anchor.c, from Lukas Wunner. 2013 201426 September 2019: Wouter 2015 - Merge #87 from hardfalcon: Fix contrib/unbound.service.in, 2016 Drop CAP_KILL, use + prefix for ExecReload= instead. 2017 201825 September 2019: Wouter 2019 - The unbound.conf includes are sorted ascending, for include 2020 statements with a '*' from glob. 2021 202223 September 2019: Wouter 2023 - Merge #85 for #84 from sam-lunt: Add kill capability to systemd 2024 service file to fix that systemctl reload fails. 2025 202620 September 2019: Wouter 2027 - Merge #82 from hardfalcon: Downgrade CAP_NET_ADMIN to CAP_NET_RAW 2028 in unbound.service. 2029 - Merge #81 from Maryse47: Consistently use /dev/urandom instead 2030 of /dev/random in scripts and docs. 2031 - Merge #83 from Maryse47: contrib/unbound.service.in: do not fork 2032 into the background. 2033 203419 September 2019: Wouter 2035 - Fix #78: Memory leak in outside_network.c. 2036 - Merge pull request #76 from Maryse47: Improvements and fixes for 2037 systemd unbound.service. 2038 - oss-fuzz badge on README.md. 2039 - Fix fix for #78 to also free service callback struct. 2040 - Fix for oss-fuzz build warning. 2041 - Fix wrong response ttl for prepended short CNAME ttls, this would 2042 create a wrong zero_ttl response count with serve-expired enabled. 2043 - Merge #80 from stasic: Improve wording in man page. 2044 204511 September 2019: Wouter 2046 - Use explicit bzero for wiping clear buffer of hash in cachedb, 2047 reported by Eric Sesterhenn from X41 D-Sec. 2048 20499 September 2019: Wouter 2050 - Fix #72: configure --with-syslog-facility=LOCAL0-7 with default 2051 LOG_DAEMON (as before) can set the syslog facility that the server 2052 uses to log messages. 2053 20544 September 2019: Wouter 2055 - Fix #71: fix openssl error squelch commit compilation error. 2056 20573 September 2019: Wouter 2058 - squelch DNS over TLS errors 'ssl handshake failed crypto error' 2059 on low verbosity, they show on verbosity 3 (query details), because 2060 there is a high volume and the operator cannot do anything for the 2061 remote failure. Specifically filters the high volume errors. 2062 20632 September 2019: Wouter 2064 - ipset module #28: log that an address is added, when verbosity high. 2065 - ipset: refactor long routine into three smaller ones. 2066 - updated Makefile dependencies. 2067 206823 August 2019: Wouter 2069 - Fix contrib/fastrpz.patch asprintf return value checks. 2070 207122 August 2019: Wouter 2072 - Fix that pkg-config is setup before --enable-systemd needs it. 2073 - 1.9.3rc2 release candidate tag. And this became the 1.9.3 release. 2074 Master is 1.9.4 in development. 2075 207621 August 2019: Wouter 2077 - Fix log_dns_msg to log irrespective of minimal responses config. 2078 207919 August 2019: Ralph 2080 - Document limitation of pidfile removal outside of chroot directory. 2081 208216 August 2019: Wouter 2083 - Fix unittest valgrind false positive uninitialised value report, 2084 where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0 2085 issues an uninitialised value for the token buffer at the str2wire.c 2086 rrinternal_get_owner() strcmp with the '@' value. Rewritten to use 2087 straight character comparisons removes the false positive. Also 2088 valgrinds --expensive-definedness-checks=yes can stop this false 2089 positive. 2090 - Please doxygen's parser for "@" occurrence in doxygen comment. 2091 - Fixup contrib/fastrpz.patch 2092 - Remove warning about unknown cast-function-type warning pragma. 2093 209415 August 2019: Wouter 2095 - iana portlist updated. 2096 - Fix autotrust temp file uniqueness windows compile. 2097 - avoid warning about upcast on 32bit systems for autotrust. 2098 - escape commandline contents for -V. 2099 - Fix character buffer size in ub_ctx_hosts. 2100 - 1.9.3rc1 release candidate tag. 2101 - Option -V prints if TCP fastopen is available. 2102 210314 August 2019: George 2104 - Fix #59, when compiled with systemd support check that we can properly 2105 communicate with systemd through the `NOTIFY_SOCKET`. 2106 210714 August 2019: Wouter 2108 - Generate configlexer with newer flex. 2109 - Fix warning for unused variable for compilation without systemd. 2110 211112 August 2019: George 2112 - Introduce `-V` option to print the version number and build options. 2113 Previously reported build options like linked libs and linked modules 2114 are now moved from `-h` to `-V` as well for consistency. 2115 - PACKAGE_BUGREPORT now also includes link to GitHub issues. 2116 21171 August 2019: Wouter 2118 - For #52 #53, second context does not close logfile override. 2119 - Fix #52 #53, fix for example fail program. 2120 - Fix to return after failed auth zone http chunk write. 2121 - Fix to remove unused test for task_probe existance. 2122 - Fix to timeval_add for remaining second in microseconds. 2123 - Check repinfo in worker_handle_request, if null, drop it. 2124 212529 July 2019: Wouter 2126 - Add verbose log message when auth zone file is written, at level 4. 2127 - Add hex print of trust anchor pointer to trust anchor file temp 2128 name to make it unique, for libunbound created multiple contexts. 2129 213023 July 2019: Wouter 2131 - Fix question section mismatch in local zone redirect. 2132 213319 July 2019: Wouter 2134 - Fix #49: Set no renegotiation on the SSL context to stop client 2135 session renegotiation. 2136 213712 July 2019: Wouter 2138 - Fix #48: Unbound returns additional records on NODATA response, 2139 if minimal-responses is enabled, also the additional for negative 2140 responses is removed. 2141 21429 July 2019: Ralph 2143 - Fix in respip addrtree selection. Absence of addr_tree_init_parents() 2144 call made it impossible to go up the tree when the matching netmask is 2145 too specific. 2146 21475 July 2019: Ralph 2148 - Fix for possible assertion failure when answering respip CNAME from 2149 cache. 2150 215125 June 2019: Wouter 2152 - For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf 2153 when do-not-query-localhost is turned on, or at default on, 2154 unbound-checkconf prints a warning if it is found in forward-addr or 2155 stub-addr statements. 2156 215724 June 2019: Wouter 2158 - Fix memleak in unit test, reported from the clang 8.0 static analyzer. 2159 216018 June 2019: Wouter 2161 - PR #28: IPSet module, by Kevin Chou. Created a module to support 2162 the ipset that could add the domain's ip to a list easily. 2163 Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md. 2164 - Fix to omit RRSIGs from addition to the ipset. 2165 - Fix to make unbound-control with ipset, remove unused variable, 2166 use unsigned type because of comparison, and assign null instead 2167 of compare with it. Remade lex and yacc output. 2168 - make depend 2169 - Added documentation to the ipset files (for doxygen output). 2170 - Merge PR #6: Python module: support multiple instances 2171 - Merge PR #5: Python module: define constant MODULE_RESTART_NEXT 2172 - Merge PR #4: Python module: assign something useful to the 2173 per-query data store 'qdata' 2174 - Fix python dict reference and double free in config. 2175 217617 June 2019: Wouter 2177 - Master contains version 1.9.3 in development. 2178 - Fix #39: In libunbound, leftover logfile is close()d unpredictably. 2179 - Fix for #24: Fix abort due to scan of auth zone masters using old 2180 address from previous scan. 2181 218212 June 2019: Wouter 2183 - Fix another spoolbuf storage code point, in prefetch. 2184 - 1.9.2rc3 release candidate tag. Which became the 1.9.2 release 2185 on 17 June 2019. 2186 218711 June 2019: Wouter 2188 - Fix that fixes the Fix that spoolbuf is not used to store tcp 2189 pipelined response between mesh send and callback end, this fixes 2190 error cases that did not use the correct spoolbuf. 2191 - 1.9.2rc2 release candidate tag. 2192 21936 June 2019: Wouter 2194 - 1.9.2rc1 release candidate tag. 2195 21964 June 2019: Wouter 2197 - iana portlist updated. 2198 219929 May 2019: Wouter 2200 - Fix to guard _OPENBSD_SOURCE from redefinition. 2201 220228 May 2019: Wouter 2203 - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD. 2204 - gitignore config.h.in~. 2205 220627 May 2019: Wouter 2207 - Fix double file close in tcp pipelined response code. 2208 220924 May 2019: Wouter 2210 - Fix that spoolbuf is not used to store tcp pipelined response 2211 between mesh send and callback end. 2212 221320 May 2019: Wouter 2214 - Note that so-reuseport at extreme load is better turned off, 2215 otherwise queries are not distributed evenly, on Linux 4.4.x. 2216 221716 May 2019: Wouter 2218 - Fix #31: swig 4.0 and python module. 2219 222013 May 2019: Wouter 2221 - Squelch log messages from tcp send about connection reset by peer. 2222 They can be enabled with verbosity at higher values for diagnosing 2223 network connectivity issues. 2224 - Attempt to fix malformed tcp response. 2225 22269 May 2019: Wouter 2227 - Revert fix for oss-fuzz, error is in that build script that 2228 unconditionally includes .o files detected by configure, also 2229 when the machine architecture uses different LIBOBJS files. 2230 22318 May 2019: Wouter 2232 - Attempt to fix build failure in oss-fuzz because of reallocarray. 2233 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648. 2234 Does not omit compile flags from commandline. 2235 22367 May 2019: Wouter 2237 - Fix edns-subnet locks, in error cases the lock was not unlocked. 2238 - Fix doxygen output error on readme markdown vignettes. 2239 22406 May 2019: Wouter 2241 - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64. 2242 - Fix #30: AddressSanitizer finding in lookup3.c. This sets the 2243 hash function to use a slower but better auditable code that does 2244 not read beyond array boundaries. This makes code better security 2245 checkable, and is better for security. It is fixed to be slower, 2246 but not read outside of the array. 2247 22482 May 2019: Wouter 2249 - contrib/fastrpz.patch updated for code changes, and with git diff. 2250 - Fix .gitignore, add pythonmod and dnstap generated files. 2251 And unit test generated files, and generated doc files. 2252 22531 May 2019: Wouter 2254 - Update makedist for git. 2255 - Nicer travis output for clang analysis. 2256 - PR #16: XoT support, AXFR over TLS, turn it on with 2257 master: <ip>#<authname> in unbound.conf. This uses TLS to 2258 download the AXFR (or IXFR). 2259 226025 April 2019: Wouter 2261 - Fix wrong query name in local zone redirect answers with a CNAME, 2262 the copy of the local alias is in unpacked form. 2263 226418 April 2019: Ralph 2265 - Scrub RRs from answer section when reusing NXDOMAIN message for 2266 subdomain answers. 2267 - For harden-below-nxdomain: do not consider a name to be non-exitent 2268 when message contains a CNAME record. 2269 227018 April 2019: Wouter 2271 - travis build file. 2272 227316 April 2019: Wouter 2274 - Better braces in if statement in TCP fastopen code. 2275 - iana portlist updated. 2276 227715 April 2019: Wouter 2278 - Fix tls write event for read state change to re-call SSL_write and 2279 not resume the TLS handshake. 2280 228111 April 2019: George 2282 - Update python documentation for init_standard(). 2283 - Typos. 2284 228511 April 2019: Wouter 2286 - Fix that auth zone uses correct network type for sockets for 2287 SOA serial probes. This fixes that probes fail because earlier 2288 probe addresses are unreachable. 2289 - Fix that auth zone fails over to next master for timeout in tcp. 2290 - Squelch SSL read and write connection reset by peer and broken pipe 2291 messages. Verbosity 2 and higher enables them. 2292 22938 April 2019: Wouter 2294 - Fix to use event_assign with libevent for thread-safety. 2295 - verbose information about auth zone lookup process, also lookup 2296 start, timeout and fail. 2297 - Fix #17: Add python module example from Jan Janak, that is a 2298 plugin for the Unbound DNS resolver to resolve DNS records in 2299 multicast DNS [RFC 6762] via Avahi. The plugin communicates 2300 with Avahi via DBus. The comment section at the beginning of 2301 the file contains detailed documentation. 2302 - Fix to wipe ssl ticket keys from memory with explicit_bzero, 2303 if available. 2304 23055 April 2019: Wouter 2306 - Fix to reinit event structure for accepted TCP (and TLS) sockets. 2307 23084 April 2019: Wouter 2309 - Fix spelling error in log output for event method. 2310 23113 April 2019: Wouter 2312 - Move goto label in answer_from_cache to the end of the function 2313 where it is more visible. 2314 - Fix auth-zone NSEC3 response for wildcard nodata answers, 2315 include the closest encloser in the answer. 2316 23172 April 2019: Wouter 2318 - Fix auth-zone NSEC3 response for empty nonterminals with exact 2319 match nsec3 records. 2320 - Fix for out of bounds integers, thanks to OSTIF audit. It is in 2321 allocation debug code. 2322 - Fix for auth zone nsec3 ent fix for wildcard nodata. 2323 232425 March 2019: Wouter 2325 - Fix that tls-session-ticket-keys: "" on its own in unbound.conf 2326 disables the tls session ticker key calls into the OpenSSL API. 2327 - Fix crash if tls-servic-pem not filled in when necessary. 2328 232921 March 2019: Wouter 2330 - Fix #4240: Fix whitespace cleanup in example.conf. 2331 233219 March 2019: Wouter 2333 - add type CAA to libpyunbound (accessing libunbound from python). 2334 233518 March 2019: Wouter 2336 - Add log message, at verbosity 4, that says the query is encrypted 2337 with TLS, if that is enabled for the query. 2338 - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482. 2339 23407 March 2019: Wouter 2341 - Fix for #4233: guard use of NDEBUG, so that it can be passed in 2342 CFLAGS into configure. 2343 23445 March 2019: Wouter 2345 - Tag release 1.9.1rc1. Which became 1.9.1 on 12 March 2019. Trunk 2346 has 1.9.2 in development. 2347 23481 March 2019: Wouter 2349 - output forwarder log in ssl_req_order test. 2350 235128 February 2019: Wouter 2352 - Remove memory leak on pythonmod python2 script file init. 2353 - Remove swig gcc8 python function cast warnings, they are ignored. 2354 - Print correct module that failed when module-config is wrong. 2355 235627 February 2019: Wouter 2357 - Fix #4229: Unbound man pages lack information, about access-control 2358 order and local zone tags, and elements in views. 2359 - Fix #14: contrib/unbound.init: Fix wrong comparison judgment 2360 before copying. 2361 - Fix for python module on Windows, fix fopen. 2362 236325 February 2019: Wouter 2364 - Fix #4227: pair event del and add for libevent for tcp_req_info. 2365 236621 February 2019: Wouter 2367 - Fix the error for unknown module in module-config is understandable, 2368 and explains it was not compiled in and where to see the list. 2369 - In example.conf explain where to put cachedb module in module-config. 2370 - In man page and example config explain that most modules have to 2371 be listed at the start of module-config. 2372 237320 February 2019: Wouter 2374 - Fix pythonmod include and sockaddr_un ifdefs for compile on 2375 Windows, and for libunbound. 2376 237718 February 2019: Wouter 2378 - Print query name with ip_ratelimit exceeded log lines. 2379 - Spaces instead of tabs in that log message. 2380 - Print query name and IP address when domain rate limit exceeded. 2381 238214 February 2019: Wouter 2383 - Fix capsforid canonical sort qsort callback. 2384 238511 February 2019: Wouter 2386 - Note default for module-config in man page. 2387 - Fix recursion lame test for qname minimisation asked queries, 2388 that were not present in the set of prepared answers. 2389 - Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for 2390 cert name matching, from man page. 2391 - make depend, with newer gcc, nicer layout. 2392 23937 February 2019: Wouter 2394 - Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2. 2395 - Fix that qname minimisation does not skip a label when missing 2396 nameserver targets need to be fetched. 2397 - Fix #4225: clients seem to erroneously receive no answer with 2398 DNS-over-TLS and qname-minimisation. 2399 24004 February 2019: Wouter 2401 - Fix that log-replies prints the correct name for local-alias 2402 names, for names that have a CNAME in local-data configuration. 2403 It logs the original query name, not the target of the CNAME. 2404 - Add local-zone type inform_redirect, which logs like type inform, 2405 and redirects like type redirect. 2406 - Perform canonical sort for 0x20 capsforid compare of replies, 2407 this sorts rrsets in the authority and additional section before 2408 comparison, so that out of order rrsets do not cause failure. 2409 241031 January 2019: Wouter 2411 - Set ub_ctx_set_tls call signature in ltrace config file for 2412 libunbound in contrib/libunbound.so.conf. 2413 - improve documentation for tls-service-key and forward-first. 2414 - #10: fixed pkg-config operations, PKG_PROG_PKG_CONFIG moved out of 2415 conditional section, fixes systemd builds, from Enrico Scholz. 2416 - #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks, 2417 still supports the set_id_callback previous API. And for 1.1.0 2418 no locking callbacks are needed. 2419 - #8: Fix OpenSSL without ENGINE support compilation. 2420 - Wipe TLS session key data from memory on exit. 2421 242230 January 2019: Ralph 2423 - Fix case in which query timeout can result in marking delegation 2424 as edns_lame_known. 2425 242629 January 2019: Wouter 2427 - Fix spelling of tls-ciphers in example.conf.in. 2428 - Fix #4224: auth_xfr_notify.rpl test broken due to typo 2429 - Fix locking for libunbound context setup with broken port config. 2430 243128 January 2019: Wouter 2432 - ub_ctx_set_tls call for libunbound that enables DoT for the machines 2433 set with ub_ctx_set_fwd. Patch from Florian Obser. 2434 - Set build system for added call in the libunbound API. 2435 - List example config for root zone copy locally hosted with auth-zone 2436 as suggested from draft-ietf-dnsop-7706-bis-02. But with updated 2437 B root address. 2438 - set version to 1.9.0 for release. And this was released with the 2439 spelling for tls-ciphers fix as 1.9.0 on Feb 5. Trunk has 1.9.1 in 2440 development. 2441 244225 January 2019: Wouter 2443 - Fix that tcp for auth zone and outgoing does not remove and 2444 then gets the ssl read again applied to the deleted commpoint. 2445 - updated contrib/fastrpz.patch to cleanly diff. 2446 - no lock when threads disabled in tcp request buffer count. 2447 - remove compile warnings from libnettle compile. 2448 - output of newer lex 2.6.1 and bison 3.0.5. 2449 245024 January 2019: Wouter 2451 - Newer aclocal and libtoolize used for generating configure scripts, 2452 aclocal 1.16.1 and libtoolize 2.4.6. 2453 - Fix unit test for python 3.7 new keyword 'async'. 2454 - clang analysis fixes, assert arc4random buffer in init, 2455 no check for already checked delegation pointer in iterator, 2456 in testcode check for NULL packet matches, in perf do not copy 2457 from NULL start list when growing capacity. Adjust host and file 2458 only when present in test header read to please checker. In 2459 testcode for unknown macro operand give zero result. Initialise the 2460 passed argv array in test code. In test code add EDNS data 2461 segment copy only when nonempty. 2462 - Patch from Florian Obser fixes some compiler warnings: 2463 include mini_event.h to have a prototype for mini_ev_cmp 2464 include edns.h to have a prototype for apply_edns_options 2465 sldns_wire2str_edns_keepalive_print is only called in the wire2str, 2466 module declare it static to get rid of compiler warning: 2467 no previous prototype for function 2468 infra_find_ip_ratedata() is only called in the infra module, 2469 declare it static to get rid of compiler warning: 2470 no previous prototype for function 2471 do not shadow local variable buf in authzone 2472 auth_chunks_delete and az_nsec3_findnode are only called in the 2473 authzone module, declare them static to get rid of compiler warning: 2474 no previous prototype for function... 2475 copy_rrset() is only called in the respip module, declare it 2476 static to get rid of compiler warning: 2477 no previous prototype for function 'copy_rrset' 2478 no need for another variable "r"; gets rid of compiler warning: 2479 declaration shadows a local variable in libunbound.c 2480 no need for another variable "ns"; gets rid of compiler warning: 2481 declaration shadows a local variable in iterator.c 2482 - Moved includes and make depend. 2483 248423 January 2019: Wouter 2485 - Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites 2486 options for unbound.conf. 2487 - Fixes for the patch, and man page entry. 2488 - Fix configure to detect SSL_CTX_set_ciphersuites, for better 2489 library compatibility when compiling. 2490 - Patch for TLS session resumption from Manabu Sonoda, 2491 enable with tls-session-ticket-keys in unbound.conf. 2492 - Fixes for patch (includes, declarations, warnings). Free at end 2493 and keep config options in order read from file to keep the first 2494 one as the first one. 2495 - Fix for IXFR fallback to reset counter when IXFR does not timeout. 2496 249722 January 2019: Wouter 2498 - Fix space calculation for tcp req buffer size. 2499 - Doc for stream-wait-size and unit test. 2500 - unbound-control stats has mem.streamwait that counts TCP and TLS 2501 waiting result buffers. 2502 - Fix for #4219: secondaries not updated after serial change, unbound 2503 falls back to AXFR after IXFR gives several timeout failures. 2504 - Fix that auth zone after IXFR fallback tries the same master. 2505 250621 January 2019: Wouter 2507 - Fix tcp idle timeout test, for difference in the tcp reply code. 2508 - Unit test for tcp request reorder and timeouts. 2509 - Unit tests for ssl out of order processing. 2510 - Fix that multiple dns fragments can be carried in one TLS frame. 2511 - Add stream-wait-size: 4m config option to limit the maximum 2512 memory used by waiting tcp and tls stream replies. This avoids 2513 a denial of service where these replies use up all of the memory. 2514 251517 January 2019: Wouter 2516 - For caps-for-id fallback, use the whitelist to avoid timeout 2517 starting a fallback sequence for it. 2518 - increase mesh max activation count for capsforid long fetches. 2519 252016 January 2019: Ralph 2521 - Get ready for the DNS flag day: remove EDNS lame procedure, do not 2522 re-query without EDNS after timeout. 2523 252415 January 2019: Wouter 2525 - In the out of order processing, reset byte count for (potential) 2526 partial read. 2527 - Review fixes in out of order processing. 2528 252914 January 2019: Wouter 2530 - streamtcp option -a send queries consecutively and prints answers 2531 as they arrive. 2532 - Fix for out of order processing administration quit cleanup. 2533 - unit test for tcp out of order processing. 2534 253511 January 2019: Wouter 2536 - Initial commit for out-of-order processing for TCP and TLS. 2537 25389 January 2019: Wouter 2539 - Log query name for looping module errors. 2540 25418 January 2019: Wouter 2542 - Fix syntax in comment of local alias processing. 2543 - Fix NSEC3 record that is returned in wildcard replies from 2544 auth-zone zones with NSEC3 and wildcards. 2545 25467 January 2019: Wouter 2547 - On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN, 2548 and server tcp fastopen is enabled at compile time. 2549 - Document interaction between the tls-upstream option in the server 2550 section and forward-tls-upstream option in the forward-zone sections. 2551 - Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews, 2552 the patch adds a program used for fuzzing. 2553 255412 December 2018: Wouter 2555 - Fix for crash in dns64 module if response is null. 2556 255710 December 2018: Wouter 2558 - Fix config parser memory leaks. 2559 - ip-ratelimit-factor of 1 allows all traffic through, instead of the 2560 previous blocking everything. 2561 - Fix for FreeBSD port make with dnscrypt and dnstap enabled. 2562 - Fix #4206: support openssl 1.0.2 for TLS hostname verification, 2563 alongside the 1.1.0 and later support that is already there. 2564 - Fixup openssl 1.0.2 compile 2565 25666 December 2018: Wouter 2567 - Fix dns64 allocation in wrong region for returned internal queries. 2568 25693 December 2018: Wouter 2570 - Fix icon, no ragged edges and nicer resolutions available, for eg. 2571 Win 7 and Windows 10 display. 2572 - cache-max-ttl also defines upperbound of initial TTL in response. 2573 257430 November 2018: Wouter 2575 - Patch for typo in unbound.conf man page. 2576 - log-tag-queryreply: yes in unbound.conf tags the log-queries and 2577 log-replies in the log file for easier log filter maintenance. 2578 257929 November 2018: Wouter 2580 - iana portlist updated. 2581 - Fix chroot auth-zone fix to remove chroot prefix. 2582 - tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon 2583 updated. Trunk contains 1.8.3 in development. 2584 Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec. 2585 Trunk then became 1.8.4 in development. 2586 - Fix that unbound-checkconf does not complains if the config file 2587 is not placed inside the chroot. 2588 - Refuse to start with no ports. 2589 - Remove clang analysis warnings. 2590 259128 November 2018: Wouter 2592 - Fix leak in chroot fix for auth-zone. 2593 - Fix clang analysis for outside directory build test. 2594 259527 November 2018: Wouter 2596 - Fix DNS64 to not store intermediate results in cache, this avoids 2597 other threads from picking up the wrong data. The module restores 2598 the previous no_cache_store setting when the the module is finished. 2599 - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work. 2600 - New and better fix for Fix #4193: Fix that prefetch failure does 2601 not overwrite valid cache entry with SERVFAIL. 2602 - auth-zone give SERVFAIL when expired, fallback activates when 2603 expired, and this is documented in the man page. 2604 - stat count SERVFAIL downstream auth-zone queries for expired zones. 2605 - Put new logos into windows installer. 2606 - Fix windows compile for new rrset roundrobin fix. 2607 - Update contrib fastrpz patch for latest release. 2608 260926 November 2018: Wouter 2610 - Fix to not set GLOB_NOSORT so the unbound.conf include: files are 2611 sorted and in a predictable order. 2612 - Fix #4193: Fix that prefetch failure does not overwrite valid cache 2613 entry with SERVFAIL. 2614 - Add unbound-control view_local_datas command, like local_datas. 2615 - Fix that unbound-control can send file for view_local_datas. 2616 261722 November 2018: Wouter 2618 - With ./configure --with-pyunbound --with-pythonmodule 2619 PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests 2620 succeed for the python module. 2621 - pythonmod logs the python error and traceback on failure. 2622 - ignore debug python module for test in doxygen output. 2623 - review fixes for python module. 2624 - Fix #4209: Crash in libunbound when called from getdns. 2625 - auth zone zonefiles can be in a chroot, the chroot directory 2626 components are removed before use. 2627 - Fix that empty zonefile means the zonefile is not set and not used. 2628 - make depend. 2629 263021 November 2018: Wouter 2631 - Scrub NS records from NODATA responses as well. 2632 263320 November 2018: Wouter 2634 - Scrub NS records from NXDOMAIN responses to stop fragmentation 2635 poisoning of the cache. 2636 - Add patch from Jan Vcelak for pythonmod, 2637 add sockaddr_storage getters, add support for query callbacks, 2638 allow raw address access via comm_reply and update API documentation. 2639 - Removed compile warnings in pythonmod sockaddr routines. 2640 264119 November 2018: Wouter 2642 - Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes 2643 option in unbound.conf. 2644 26456 November 2018: Ralph 2646 - Bugfix min-client-subnet-ipv6 2647 264825 October 2018: Ralph 2649 - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options. 2650 265125 October 2018: Wouter 2652 - Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query. 2653 - Fix #4190: Please create a "ANY" deny option, adds the option 2654 deny-any: yes in unbound.conf. This responds with an empty message 2655 to queries of type ANY. 2656 - Fix #4141: More randomness to rrset-roundrobin. 2657 - Fix #4132: Openness/closeness of RANGE intervals in rpl files. 2658 - Fix #4126: RTT_band too low on VSAT links with 600+ms latency, 2659 adds the option unknown-server-time-limit to unbound.conf that 2660 can be increased to avoid the problem. 2661 - remade makefile dependencies. 2662 - Fix #4152: Logs shows wrong time when using log-time-ascii: yes. 2663 266424 October 2018: Ralph 2665 - Add markdel function to ECS slabhash. 2666 - Limit ECS scope returned to client to the scope used for caching. 2667 - Make lint like previous #4154 fix. 2668 266922 October 2018: Wouter 2670 - Fix #4192: unbound-control-setup generates keys not readable by 2671 group. 2672 - check that the dnstap socket file can be opened and exists, print 2673 error if not. 2674 - Fix #4154: make ECS_MAX_TREESIZE configurable, with 2675 the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options. 2676 267722 October 2018: Ralph 2678 - Change fast-server-num default to 3. 2679 26808 October 2018: Ralph 2681 - Add fast-server-permil and fast-server-num options. 2682 - Deprecate low-rtt and low-rtt-permil options. 2683 26848 October 2018: Wouter 2685 - Squelch log of failed to tcp initiate after TCP Fastopen failure. 2686 26875 October 2018: Wouter 2688 - Squelch EADDRNOTAVAIL errors when the interface goes away, 2689 this omits 'can't assign requested address' errors unless 2690 verbosity is set to a high value. 2691 - Set default for so-reuseport to no for FreeBSD. It is enabled 2692 by default for Linux and DragonFlyBSD. The setting can 2693 be configured in unbound.conf to override the default. 2694 - iana port update. 2695 26962 October 2018: Wouter 2697 - updated contrib/fastrpz.patch to apply for this version 2698 - dnscrypt.c removed sizeof to get array bounds. 2699 - Fix testlock code to set noreturn on error routine. 2700 - Remove unused variable from contrib fastrpz/rpz.c and 2701 remove unused diagnostic pragmas that themselves generate warnings 2702 - clang analyze test is used only when assertions are enabled. 2703 27041 October 2018: Wouter 2705 - tag for release 1.8.1rc1. Became release 1.8.1 on 8 oct, with 2706 fastrpz.patch fix included. Trunk has 1.8.2 in development. 2707 270827 September 2018: Wouter 2709 - Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes 2710 qname minimisation with a forwarder when connectivity has issues 2711 from rejecting responses. 2712 271325 September 2018: Wouter 2714 - Perform TLS SNI indication of the host that is being contacted 2715 for DNS over TLS service. It sets the configured tls auth name. 2716 This is useful for hosts that apart from the DNS over TLS services 2717 also provide other (web) services. 2718 - Fix #4149: Add SSL cleanup for tcp timeout. 2719 272017 September 2018: Wouter 2721 - Fix compile on Mac for unbound, provide explicit_bzero when libc 2722 does not have it. 2723 - Fix unbound for openssl in FIPS mode, it uses the digests with 2724 the EVP call contexts. 2725 - Fix that with harden-below-nxdomain and qname minisation enabled 2726 some iterator states for nonresponsive domains can get into a 2727 state where they waited for an empty list. 2728 - Stop UDP to TCP failover after timeouts that causes the ping count 2729 to be reset by the TCP time measurement (that exists for TLS), 2730 because that causes the UDP part to not be measured as timeout. 2731 - Fix #4156: Fix systemd service manager state change notification. 2732 273313 September 2018: Wouter 2734 - Fix seed for random backup code to use explicit zero when wiped. 2735 - exit log routine is annotated as noreturn function. 2736 - free memory leaks in config strlist and str2list insert functions. 2737 - do not move unused argv variable after getopt. 2738 - Remove unused if clause in testcode. 2739 - in testcode, free async ids, initialise array, and check for null 2740 pointer during test of the test. And use exit for return to note 2741 irregular program stop. 2742 - Free memory leak in config strlist append. 2743 - make sure nsec3 comparison salt is initialized. 2744 - unit test has clang analysis. 2745 - remove unused variable assignment from iterator scrub routine. 2746 - check for null in delegation point during iterator refetch 2747 in forward zone. 2748 - neater pointer cast in libunbound context quit routine. 2749 - initialize statistics totals for printout. 2750 - in authzone check that node exists before adding rrset. 2751 - in unbound-anchor, use readwrite memory BIO. 2752 - assertion in autotrust that packed rrset is formed correctly. 2753 - Fix memory leak when message parse fails partway through copy. 2754 - remove unused udpsize assignment in message encode. 2755 - nicer bio free code in unbound-anchor. 2756 - annotate exit functions with noreturn in unbound-control. 2757 275811 September 2018: Wouter 2759 - Fixed unused return value warnings in contrib/fastrpz.patch for 2760 asprintf. 2761 - Fix to squelch respip warning in unit test, it is printed at 2762 higher verbosity settings. 2763 - Fix spelling errors. 2764 - Fix initialisation in remote.c 2765 276610 September 2018: Wouter 2767 - 1.8.1 in svn trunk. (changes from 4,5,.. sep apply). 2768 - iana port update. 2769 27705 September 2018: Wouter 2771 - Fix spelling error in header, from getdns commit by Andreas Gelmini. 2772 27734 September 2018: Ralph 2774 - More explicitly mention the type of ratelimit when applying 2775 ip-ratelimit. 2776 27774 September 2018: Wouter 2778 - Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018. 2779 278031 August 2018: Wouter 2781 - Disable minimal-responses in subnet unit tests. 2782 278330 August 2018: Wouter 2784 - Fix that a local-zone with a local-zone-type that is transparent 2785 in a view with view-first, makes queries check for answers from the 2786 local-zones defined outside of views. 2787 278828 August 2018: Ralph 2789 - Disable minimal-responses in ipsecmod unit tests. 2790 - Added serve-expired-ttl and serve-expired-ttl-reset options. 2791 279227 August 2018: Wouter 2793 - Set defaults to yes for a number of options to increase speed and 2794 resilience of the server. The so-reuseport, harden-below-nxdomain, 2795 and minimal-responses options are enabled by default. They used 2796 to be disabled by default, waiting to make sure they worked. They 2797 are enabled by default now, and can be disabled explicitly by 2798 setting them to "no" in the unbound.conf config file. The reuseport 2799 and minimal options increases speed of the server, and should be 2800 otherwise harmless. The harden-below-nxdomain option works well 2801 together with the recently default enabled qname minimisation, this 2802 causes more fetches to use information from the cache. 2803 - next release is called 1.8.0. 2804 - Fix lintflags for lint on FreeBSD. 2805 280622 August 2018: George 2807 - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This 2808 gives access to reply information for the client's communication 2809 point when the callback is called before the mesh state (modules). 2810 Changes to C and Python's inplace_callback signatures were also 2811 necessary. 2812 281321 August 2018: Wouter 2814 - log-local-actions: yes option for unbound.conf that logs all the 2815 local zone actions, a patch from Saksham Manchanda (Secure64). 2816 - #4146: num.query.subnet and num.query.subnet_cache counters. 2817 - Fix only misc failure from log-servfail when val-log-level is not 2818 enabled. 2819 282017 August 2018: Ralph 2821 - Fix classification for QTYPE=CNAME queries when QNAME minimisation is 2822 enabled. 2823 282417 August 2018: Wouter 2825 - Set libunbound to increase current, because the libunbound change 2826 to the event callback function signature. That needs programs, 2827 that use it, to recompile against the new header definition. 2828 - print servfail info to log as error. 2829 - added more servfail printout statements, to the iterator. 2830 - log-servfail: yes prints log lines that say why queries are 2831 returning SERVFAIL to clients. 2832 283316 August 2018: Wouter 2834 - Fix warning on compile without threads. 2835 - Fix contrib/fastrpz.patch. 2836 283715 August 2018: Wouter 2838 - Fix segfault in auth-zone read and reorder of RRSIGs. 2839 284014 August 2018: Wouter 2841 - Fix that printout of error for cycle targets is a verbosity 4 2842 printout and does not wrongly print it is a memory error. 2843 - Upgraded crosscompile script to include libunbound DLL in the 2844 zipfile. 2845 284610 August 2018: Wouter 2847 - Fix #4144: dns64 module caches wrong (negative) information. 2848 28499 August 2018: Wouter 2850 - unbound-checkconf checks if modules exist and prints if they are 2851 not compiled in the name of the wrong module. 2852 - document --enable-subnet in doc/README. 2853 - Patch for stub-no-cache and forward-no-cache options that disable 2854 caching for the contents of that stub or forward, for when you 2855 want immediate changes visible, from Bjoern A. Zeeb. 2856 28577 August 2018: Ralph 2858 - Make capsforid fallback QNAME minimisation aware. 2859 28607 August 2018: Wouter 2861 - Fix #4142: unbound.service.in: improvements and fixes. 2862 Add unit dependency ordering (based on systemd-resolved). 2863 Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings 2864 about missing privileges during startup). Add 'AF_INET6' to 2865 'RestrictAddressFamilies' (without it IPV6 can't work). From 2866 Guido Shanahan. 2867 - Patch to implement tcp-connection-limit from Jim Hague (Sinodun). 2868 This limits the number of simultaneous TCP client connections 2869 from a nominated netblock. 2870 - make depend, yacc, lex, doc, headers. And log the limit exceeded 2871 message only on high verbosity, so as to not spam the logs when 2872 it is busy. 2873 28746 August 2018: Wouter 2875 - Fix for #4136: Fix to unconditionally call destroy in daemon.c. 2876 28773 August 2018: George 2878 - Expose if a query (or a subquery) was ratelimited (not src IP 2879 ratelimiting) to libunbound under 'ub_result.was_ratelimited'. 2880 This also introduces a change to 'ub_event_callback_type' in 2881 libunbound/unbound-event.h. 2882 - Tidy pylib tests. 2883 28843 August 2018: Wouter 2885 - Revert previous change for #4136: because it introduces build 2886 problems. 2887 - New fix for #4136: This one ignores lex without without 2888 yylex_destroy. 2889 28901 August 2018: Wouter 2891 - Fix to remove systemd sockaddr function check, that is not 2892 always present. Make socket activation more lenient. But not 2893 different when socket activation is not used. 2894 - iana port list update. 2895 289631 July 2018: Wouter 2897 - Patches from Jim Hague (Sinodun) for EDNS KeepAlive. 2898 - Sort out test runs when the build directory isn't the project 2899 root directory. 2900 - Add config tcp-idle-timeout (default 30s). This applies to 2901 client connections only; the timeout on TCP connections upstream 2902 is unaffected. 2903 - Error if EDNS Keepalive received over UDP. 2904 - Add edns-tcp-keepalive and edns-tcp-keepalive timeout options 2905 and implement option in client responses. 2906 - Correct and expand manual page entries for keepalive and idle timeout. 2907 - Implement progressive backoff of TCP idle/keepalive timeout. 2908 - Fix 'make depend' to work when build dir is not project root. 2909 - Add delay parameter to streamtcp, -d secs. 2910 To be used when testing idle timeout. 2911 - From Wouter: make depend, the dependencies in the patches did not 2912 apply cleanly. Also remade yacc and lex. 2913 - Fix mesh.c incompatible pointer pass. 2914 - Please doxygen so it passes. 2915 - Fix #4139: Fix unbound-host leaks memory on ANY. 2916 291730 July 2018: Wouter 2918 - Fix #4136: insufficiency from mismatch of FLEX capability between 2919 released tarball and build host. 2920 292127 July 2018: Wouter 2922 - Fix man page, say that chroot is enabled by default. 2923 292426 July 2018: Wouter 2925 - Fix #4135: 64-bit Windows Installer Creates Entries Under The 2926 Wrong Registry Key, reported by Brian White. 2927 292823 July 2018: Wouter 2929 - Fix use-systemd readiness signalling, only when use-systemd is yes 2930 and not in signal handler. 2931 293220 July 2018: Wouter 2933 - Fix #4130: print text describing -dd and unbound-checkconf on 2934 config file read error at startup, the errors may have been moved 2935 away by the startup process. 2936 - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared. 2937 293819 July 2018: Wouter 2939 - Fix #4129 unbound-control error message with wrong cert permissions 2940 is too cryptic. 2941 294217 July 2018: Wouter 2943 - Fix #4127 unbound -h does not list -p help. 2944 - Print error if SSL name verification configured but not available 2945 in the ssl library. 2946 - Fix that ratelimit and ip-ratelimit are applied after reload of 2947 changed config file. 2948 - Resize ratelimit and ip-ratelimit caches if changed on reload. 2949 295016 July 2018: Wouter 2951 - Fix qname minimisation NXDOMAIN validation lookup failures causing 2952 error_supers assertion fails. 2953 - Squelch can't bind socket errors with Permission denied unless 2954 verbosity is 4 or higher, for UDP outgoing sockets. 2955 295612 July 2018: Wouter 2957 - Fix to improve systemd socket activation code file descriptor 2958 assignment. 2959 - Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more 2960 easily changed to adjust default rtt assumptions. 2961 296210 July 2018: Wouter 2963 - Note in documentation that the cert name match code needs 2964 OpenSSL 1.1.0 or later to be enabled. 2965 29666 July 2018: Wouter 2967 - Fix documentation ambiguity for tls-win-cert in tls-upstream and 2968 forward-tls-upstream docs. 2969 - iana port update. 2970 - Note RFC8162 support. SMIMEA record type can be read in by the 2971 zone record parser. 2972 - Fix round robin for failed addresses with prefer-ip6: yes 2973 29744 July 2018: Wouter 2975 - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass 2976 if DNSSEC is not enabled. New option -R allows fallback from 2977 resolv.conf to direct queries. 2978 29793 July 2018: Wouter 2980 - Better documentation for unblock-lan-zones and insecure-lan-zones 2981 config statements. 2982 - Fix permission denied printed for auth zone probe random port nrs. 2983 29842 July 2018: Wouter 2985 - Fix checking for libhiredis printout in configure output. 2986 - Fix typo on man page in ip-address description. 2987 - Update libunbound/python/examples/dnssec_test.py example code to 2988 also set the 20326 trust anchor for the root in the example code. 2989 299029 June 2018: Wouter 2991 - dns64-ignore-aaaa: config option to list domain names for which the 2992 existing AAAA is ignored and dns64 processing is used on the A 2993 record. 2994 299528 June 2018: Wouter 2996 - num.queries.tls counter for queries over TLS. 2997 - log port number with err_addr logs. 2998 299927 June 2018: Wouter 3000 - #4109: Fix that package config depends on python unconditionally. 3001 - Patch, do not export python from pkg-config, from Petr Menšík. 3002 300326 June 2018: Wouter 3004 - Partial fix for permission denied on IPv6 address on FreeBSD. 3005 - Fix that auth-zone master reply with current SOA serial does not 3006 stop scan of masters for an updated zone. 3007 - Fix that auth-zone does not start the wait timer without checking 3008 if the wait timer has already been started. 3009 301021 June 2018: Wouter 3011 - #4108: systemd reload hang fix. 3012 - Fix usage printout for unbound-host, hostname has to be last 3013 argument on BSDs and Windows. 3014 301519 June 2018: Wouter 3016 - Fix for unbound-control on Windows and set TCP socket parameters 3017 more closely. 3018 This fix is part of 1.7.3. 3019 - Windows example service.conf edited with more windows specific 3020 configuration. 3021 - Fix windows unbound-control no cert bad file descriptor error. 3022 This fix is part of 1.7.3. 3023 302418 June 2018: Wouter 3025 - Fix that control-use-cert: no works for 127.0.0.1 to disable certs. 3026 This fix is part of 1.7.3rc2. 3027 - Fix unbound-checkconf for control-use-cert. 3028 This fix is part of 1.7.3. 3029 303015 June 2018: Wouter 3031 - tag for 1.7.3rc1. 3032 - trunk has 1.7.4. 3033 - unbound-control auth_zone_reload _zone_ option rereads the zonefile. 3034 - unbound-control auth_zone_transfer _zone_ option starts the probe 3035 sequence for a master to transfer the zone from and transfers when 3036 a new zone version is available. 3037 303814 June 2018: Wouter 3039 - #4103: Fix that auth-zone does not insist on SOA record first in 3040 file for url downloads. 3041 - Fix that first control-interface determines if TLS is used. Warn 3042 when IP address interfaces are used without TLS. 3043 - Fix nettle compile. 3044 304512 June 2018: Ralph 3046 - Don't count CNAME response types received during qname minimisation as 3047 query restart. 3048 304912 June 2018: Wouter 3050 - #4102 for NSD, but for Unbound. Named unix pipes do not use 3051 certificate and key files, access can be restricted with file and 3052 directory permissions. The option control-use-cert is no longer 3053 used, and ignored if found in unbound.conf. 3054 - Rename tls-additional-ports to tls-additional-port, because every 3055 line adds one port. 3056 - Fix buffer size warning in unit test. 3057 - remade dependencies in the Makefile. 3058 30596 June 2018: Wouter 3060 - Patch to fix openwrt for mac os build darwin detection in configure. 3061 30625 June 2018: Wouter 3063 - Fix crash if ratelimit taken into use with unbound-control 3064 instead of with unbound.conf. 3065 30664 June 2018: Wouter 3067 - Fix deadlock caused by incoming notify for auth-zone. 3068 - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018, 3069 trunk is 1.7.3 in development from this point. 3070 - #4100: Fix stub reprime when it becomes useless. 3071 30721 June 2018: Wouter 3073 - Rename additional-tls-port to tls-additional-ports. 3074 The older name is accepted for backwards compatibility. 3075 307630 May 2018: Wouter 3077 - Patch from Syzdek: Add ability to ignore RD bit and treat all 3078 requests as if the RD bit is set. 3079 308029 May 2018: Wouter 3081 - in compat/arc4random call getentropy_urandom when getentropy fails 3082 with ENOSYS. 3083 - Fix that fallback for windows port. 3084 308528 May 2018: Wouter 3086 - Fix windows tcp and tls spin on events. 3087 - Add routine from getdns to add windows cert store to the SSL_CTX. 3088 - tls-win-cert option that adds the system certificate store for 3089 authenticating DNS-over-TLS connections. It can be used instead 3090 of the tls-cert-bundle option, or with it to add certificates. 3091 309225 May 2018: Wouter 3093 - For TCP and TLS connections that don't establish, perform address 3094 update in infra cache, so future selections can exclude them. 3095 - Fix that tcp sticky events are removed for closed fd on windows. 3096 - Fix close events for tcp only. 3097 309824 May 2018: Wouter 3099 - Fix that libunbound can do DNS-over-TLS, when configured. 3100 - Fix that windows unbound service can use DNS-over-TLS. 3101 - unbound-host initializes ssl (for potential DNS-over-TLS usage 3102 inside libunbound), when ssl upstream or a cert-bundle is configured. 3103 310423 May 2018: Wouter 3105 - Use accept4 to speed up incoming TCP (and TLS) connections, 3106 available on Linux, FreeBSD and OpenBSD. 3107 310817 May 2018: Ralph 3109 - Qname minimisation default changed to yes. 3110 311115 May 2018: Wouter 3112 - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand. 3113 311411 May 2018: Wouter 3115 - Fix contrib/libunbound.pc for libssl libcrypto references, 3116 from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914 3117 31187 May 2018: Wouter 3119 - Fix windows to not have sticky TLS events for TCP. 3120 - Fix read of DNS over TLS length and data in one read call. 3121 - Fix mesh state assertion failure due to callback removal. 3122 31233 May 2018: Wouter 3124 - Fix that configure --with-libhiredis also turns on cachedb. 3125 - Fix gcc 8 buffer warning in testcode. 3126 - Fix function type cast warning in libunbound context callback type. 3127 31282 May 2018: Wouter 3129 - Fix fail to reject dead peers in forward-zone, with ssl-upstream. 3130 31311 May 2018: Wouter 3132 - Fix that unbound-control reload frees the rrset keys and returns 3133 the memory pages to the system. 3134 313530 April 2018: Wouter 3136 - Fix spelling error in man page and note defaults as no instead of 3137 off. 3138 313926 April 2018: Wouter 3140 - Fix for crash in daemon_cleanup with dnstap during reload, 3141 from Saksham Manchanda. 3142 - Also that for dnscrypt. 3143 - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk 3144 is from here 1.7.2 in development. 3145 314625 April 2018: Ralph 3147 - Fix memory leak when caching wildcard records for aggressive NSEC use 3148 314924 April 2018: Wouter 3150 - Fix contrib/fastrpz.patch for this release. 3151 - Fix auth https for libev. 3152 315324 April 2018: Ralph 3154 - Added root-key-sentinel support 3155 315623 April 2018: Wouter 3157 - makedist uses bz2 for expat code, instead of tar.gz. 3158 - Fix #4092: libunbound: use-caps-for-id lacks colon in 3159 config_set_option. 3160 - auth zone http download stores exact copy of downloaded file, 3161 including comments in the file. 3162 - Fix sldns parse failure for CDS alternate delete syntax empty hex. 3163 - Attempt for auth zone fix; add of callback in mesh gets from 3164 callback does not skip callback of result. 3165 - Fix cname classification with qname minimisation enabled. 3166 - list_auth_zones unbound-control command. 3167 316820 April 2018: Wouter 3169 - man page documentation for dns-over-tls forward-addr '#' notation. 3170 - removed free from failed parse case. 3171 - Fix #4091: Fix that reload of auth-zone does not merge the zonefile 3172 with the previous contents. 3173 - Delete auth zone when removed from config. 3174 317519 April 2018: Wouter 3176 - Can set tls authentication with forward-addr: IP#tls.auth.name 3177 And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem". 3178 such as forward-addr: 9.9.9.9@853#dns.quad9.net or 3179 1.1.1.1@853#cloudflare-dns.com 3180 - Fix #658: unbound using TLS in a forwarding configuration does not 3181 verify the server's certificate (RFC 8310 support). 3182 - For addr with #authname and no @port notation, the default is 853. 3183 318418 April 2018: Wouter 3185 - Fix auth-zone retry timer to be on schedule with retry timeout, 3186 with backoff. Also time a refresh at the zone expiry. 3187 318817 April 2018: Wouter 3189 - auth zone notify work. 3190 - allow-notify: config statement for auth-zones. 3191 - unit test for allow-notify 3192 319316 April 2018: Wouter 3194 - Fix auth zone target lookup iterator. 3195 - auth zone notify with prefix 3196 - auth zone notify work. 3197 319813 April 2018: Wouter 3199 - Fix for max include depth for authzones. 3200 - Fix memory free on fail for $INCLUDE in authzone. 3201 - Fix that an internal error to look up the wrong rr type for 3202 auth zone gets stopped, before trying to send there. 3203 - auth zone notify work. 3204 320510 April 2018: Ralph 3206 - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN 3207 statistics counters. 3208 320910 April 2018: Wouter 3210 - documentation for low-rtt and low-rtt-pct. 3211 - auth zone notify work. 3212 32139 April 2018: Wouter 3214 - Fix that flush_zone sets prefetch ttl expired, so that with 3215 serve-expired enabled it'll start prefetching those entries. 3216 - num.query.authzone.up and num.query.authzone.down statistics counters. 3217 - Fix downstream auth zone, only fallback when auth zone fails to 3218 answer and fallback is enabled. 3219 - Accept both option names with and without colon for get_option 3220 and set_option. 3221 - low-rtt and low-rtt-pct in unbound.conf enable the server selection 3222 of fast servers for some percentage of the time. 3223 32245 April 2018: Wouter 3225 - Combine write of tcp length and tcp query for dns over tls. 3226 - nitpick fixes in example.conf. 3227 - Fix above stub queries for type NS and useless delegation point. 3228 - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3 3229 tls_choose_sigalg routine does not allow the ciphers for the pipe, 3230 so use TLSv1.2. 3231 - ED448 support. 3232 32333 April 2018: Wouter 3234 - Fix #4043: make test fails due to v6 presentation issue in macOS. 3235 - Fix unable to resolve after new WLAN connection, due to auth-zone 3236 failing with a forwarder set. Now, auth-zone is only used for 3237 answers (not referrals) when a forwarder is set. 3238 323929 March 2018: Ralph 3240 - Check "result" in dup_all(), by Florian Obser. 3241 324223 March 2018: Ralph 3243 - Fix unbound-control get_option aggressive-nsec 3244 324521 March 2018: Ralph 3246 - Do not use cached NSEC records to generate negative answers for 3247 domains under DNSSEC Negative Trust Anchors. 3248 324919 March 2018: Wouter 3250 - iana port update. 3251 325216 March 2018: Wouter 3253 - corrected a minor typo in the changelog. 3254 - move htobe64/be64toh portability code to cachedb.c. 3255 325615 March 2018: Wouter 3257 - Add --with-libhiredis, unbound support for a new cachedb backend 3258 that uses a Redis server as the storage. This implementation 3259 depends on the hiredis client library (https://redislabs.com/lp/hiredis/). 3260 And unbound should be built with both --enable-cachedb and 3261 --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h 3262 should exist). Patch from Jinmei Tatuya (Infoblox). 3263 - Fix #3817: core dump happens in libunbound delete, when queued 3264 servfail hits deleted message queue. 3265 - Create additional tls service interfaces by opening them on other 3266 portnumbers and listing the portnumbers as additional-tls-port: nr. 3267 326813 March 2018: Wouter 3269 - Fix typo in documentation. 3270 - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually 3271 flushed with serve-expired on. 3272 327312 March 2018: Wouter 3274 - Added documentation for aggressive-nsec: yes. 3275 - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk 3276 now has 1.7.1 in development. 3277 - Fix #3727: Protocol name is TLS, options have been renamed but 3278 documentation is not consistent. 3279 - Check IXFR start serial. 3280 32819 March 2018: Wouter 3282 - Fix #3598: Fix swig build issue on rhel6 based system. 3283 configure --disable-swig-version-check stops the swig version check. 3284 32858 March 2018: Wouter 3286 - tag 1.7.0rc2. 3287 32887 March 2018: Wouter 3289 - Fixed contrib/fastrpz.patch, even though this already applied 3290 cleanly for me, now also for others. 3291 - patch to log creates keytag queries, from A. Schulze. 3292 - patch suggested by Debian lintian: allow to -> allow one to, from 3293 A. Schulze. 3294 - Attempt to remove warning about trailing whitespace. 3295 32966 March 2018: Wouter 3297 - Reverted fix for #3512, this may not be the best way forward; 3298 although it could be changed at a later time, to stay similar to 3299 other implementations. 3300 - svn trunk contains 1.7.0, this is the number for the next release. 3301 - Fix for windows compile. 3302 - tag 1.7.0rc1. 3303 33045 March 2018: Wouter 3305 - Fix to check define of DSA for when openssl is without deprecated. 3306 - iana port update. 3307 - Fix #3582: Squelch address already in use log when reuseaddr option 3308 causes same port to be used twice for tcp connections. 3309 331027 February 2018: Wouter 3311 - Fixup contrib/fastrpz.patch so that it applies. 3312 - Fix compile without threads, and remove unused variable. 3313 - Fix compile with staticexe and python module. 3314 - Fix nettle compile. 3315 331622 February 2018: Ralph 3317 - Save wildcard RRset from answer with original owner for use in 3318 aggressive NSEC. 3319 332021 February 2018: Wouter 3321 - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query 3322 when there is a CNAME loop. 3323 - Fix validation for CNAME loops. When it detects a cname loop, 3324 by finding the cname, cname in the existing list, it returns 3325 the partial result with the validation result up to then. 3326 - more robust cachedump rrset routine. 3327 332819 February 2018: Wouter 3329 - Fix #3505: Documentation for default local zones references 3330 wrong RFC. 3331 - Fix #3494: local-zone noview can be used to break out of the view 3332 to the global local zone contents, for queries for that zone. 3333 - Fix for more maintainable code in localzone. 3334 333516 February 2018: Wouter 3336 - Fixes for clang static analyzer, the missing ; in 3337 edns-subnet/addrtree.c after the assert made clang analyzer 3338 produce a failure to analyze it. 3339 334013 February 2018: Ralph 3341 - Aggressive NSEC tests 3342 334313 February 2018: Wouter 3344 - tls-cert-bundle option in unbound.conf enables TLS authentication. 3345 - iana port update. 3346 334712 February 2018: Wouter 3348 - Unit test for auth zone https url download. 3349 335012 February 2018: Ralph 3351 - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) 3352 - Processed aggressive NSEC code review remarks Wouter 3353 33548 February 2018: Ralph 3355 - Aggressive use of NSEC implementation. Use cached NSEC records to 3356 generate NXDOMAIN, NODATA and positive wildcard answers. 3357 33588 February 2018: Wouter 3359 - iana port update. 3360 - auth zone url config. 3361 33625 February 2018: Wouter 3363 - Fix #3451: dnstap not building when you have a separate build dir. 3364 And removed protoc warning, set dnstap.proto syntax to proto2. 3365 - auth-zone provides a way to configure RFC7706 from unbound.conf, 3366 eg. with auth-zone: name: "." for-downstream: no for-upstream: yes 3367 fallback-enabled: yes and masters or a zonefile with data. 3368 33692 February 2018: Wouter 3370 - Fix unfreed locks in log and arc4random at exit of unbound. 3371 - unit test with valgrind 3372 - Fix lock race condition in dns cache dname synthesis. 3373 - lock subnet new item before insertion to please checklocks, 3374 no modification of critical regions outside of lock region. 3375 33761 February 2018: Wouter 3377 - fix unaligned structure making a false positive in checklock 3378 unitialised memory. 3379 338029 January 2018: Ralph 3381 - Use NSEC with longest ce to prove wildcard absence. 3382 - Only use *.ce to prove wildcard absence, no longer names. 3383 338425 January 2018: Wouter 3385 - ltrace.conf file for libunbound in contrib. 3386 338723 January 2018: Wouter 3388 - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file 3389 for startup scripts to get the full pathname(s) of anchor file(s). 3390 - Print fatal errors about remote control setup before log init, 3391 so that it is printed to console. 3392 339322 January 2018: Wouter 3394 - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is 3395 also recognized and means the same. Also for tls-port, 3396 tls-service-key, tls-service-pem, stub-tls-upstream and 3397 forward-tls-upstream. 3398 - Fix #3397: Fix that cachedb could return a partial CNAME chain. 3399 - Fix #3397: Fix that when the cache contains an unsigned DNAME in 3400 the middle of a cname chain, a result without the DNAME could 3401 be returned. 3402 340319 January 2018: Wouter 3404 - tag 1.6.8 for release with CVE fix. 3405 - trunk has 1.6.9 with fix and previous commits. 3406 - patch for CVE-2017-15105: vulnerability in the processing of 3407 wildcard synthesized NSEC records. 3408 - iana port update. 3409 - make depend: code dependencies updated in Makefile. 3410 34114 January 2018: Ralph 3412 - Copy query and correctly set flags on REFUSED answers when cache 3413 snooping is not allowed. 3414 34153 January 2018: Ralph 3416 - Fix queries being leaked above stub when refetching glue. 3417 34182 January 2017: Wouter 3419 - Fix that DS queries with referral replies are answered straight 3420 away, without a repeat query picking the DS from cache. 3421 The correct reply should have been an answer, the reply is fixed 3422 by the scrubber to have the answer in the answer section. 3423 - Remove clang optimizer disable, 3424 Fix that expiration date checks don't fail with clang -O2. 3425 342615 December 2017: Wouter 3427 - Fix timestamp failure because of clang optimizer failure, by 3428 disabling -O2 when the compiler --version is clang. 3429 - iana port update. 3430 - Also disable -flto for clang, to make incep-expi signature check 3431 work. 3432 343312 December 2017: Ralph 3434 - Fix qname-minimisation documentation (A QTYPE, not NS) 3435 343612 December 2017: Wouter 3437 - authzone work, transfer connect. 3438 34397 December 2017: Ralph 3440 - Check whether --with-libunbound-only is set when using --with-nettle 3441 or --with-nss. 3442 34434 December 2017: Wouter 3444 - Fix link failure on OmniOS. 3445 34461 December 2017: Wouter 3447 - auth zone work. 3448 344930 November 2017: Wouter 3450 - Fix #3299 - forward CNAME daisy chain is not working 3451 345214 November 2017: Wouter 3453 - Fix #2882: Unbound behaviour changes (wrong) when domain-insecure is 3454 set for stub zone. It no longer searches for DNSSEC information. 3455 - auth xfer work on probe timer and lookup. 3456 345713 November 2017: Wouter 3458 - Fix #2801: Install libunbound.pc. 3459 - Fix qname minimisation to send AAAA queries at zonecut like type A. 3460 - reverted AAAA change. 3461 34627 November 2017: Wouter 3463 - Fix #2492: Documentation libunbound. 3464 34653 November 2017: Wouter 3466 - Fix #2362: TLS1.3/openssl-1.1.1 not working. 3467 - Fix #2034 - Autoconf and -flto. 3468 - Fix #2141 - for libsodium detect lack of entropy in chroot, print 3469 a message and exit. 3470 34712 November 2017: Wouter 3472 - Fix #1913: ub_ctx_config is under circumstances thread-safe. 3473 - make ip-transparent option work on OpenBSD. 3474 347531 October 2017: Wouter 3476 - Document that errno is left informative on libunbound config read 3477 fail. 3478 - lexer output. 3479 - iana port update. 3480 348125 October 2017: Ralph 3482 - Fixed libunbound manual typo. 3483 - Fix #1949: [dnscrypt] make provider name mismatch more obvious. 3484 - Fix #2031: Double included headers 3485 348624 October 2017: Ralph 3487 - Update B root ipv4 address. 3488 348919 October 2017: Wouter 3490 - authzone work, probe timer setup. 3491 349218 October 2017: Wouter 3493 - lint for recent authzone commit. 3494 349517 October 2017: Wouter 3496 - Fix #1749: With harden-referral-path: performance drops, due to 3497 circular dependency in NS and DS lookups. 3498 - [dnscrypt] prevent dnscrypt-secret-key, dnscrypt-provider-cert 3499 duplicates 3500 - [dnscrypt] introduce dnscrypt-provider-cert-rotated option, 3501 from Manu Bretelle. 3502 This option allows handling multiple cert/key pairs while only 3503 distributing some of them. 3504 In order to reliably match a client magic with a given key without 3505 strong assumption as to how those were generated, we need both key and 3506 cert. Likewise, in order to know which ES version should be used. 3507 On the other hand, when rotating a cert, it can be desirable to only 3508 serve the new cert but still be able to handle clients that are still 3509 using the old certs's public key. 3510 The `dnscrypt-provider-cert-rotated` allow to instruct unbound to not 3511 publish the cert as part of the DNS's provider_name's TXT answer. 3512 - Better documentation for cache-max-negative-ttl. 3513 - Work on local root zone code. 3514 351510 October 2017: Wouter 3516 - tag 1.6.7 3517 - trunk has version 1.6.8. 3518 35196 October 2017: Wouter 3520 - Fix spelling in unbound-control man page. 3521 35225 October 2017: Wouter 3523 - Fix trust-anchor-signaling works in libunbound. 3524 - Fix some more crpls in testdata for different signaling default. 3525 - tag 1.6.7rc1 3526 35275 October 2017: Ralph 3528 - Set trust-anchor-signaling default to yes 3529 - Use RCODE from A query on DNS64 synthesized answer. 3530 35312 October 2017: Wouter 3532 - Fix param unused warning for windows exportsymbol compile. 3533 353425 September 2017: Ralph 3535 - Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch 3536 (by Danilo G. Baio). 3537 353821 September 2017: Ralph 3539 - Log name of looping module 3540 354119 September 2017: Wouter 3542 - use a cachedb answer even if it's "expired" when serve-expired is yes 3543 (patch from Jinmei Tatuya). 3544 - trigger refetching of the answer in that case (this will bypass 3545 cachedb lookup) 3546 - allow storing a 0-TTL answer from cachedb in the in-memory message 3547 cache when serve-expired is yes 3548 - Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff. 3549 355018 September 2017: Ralph 3551 - Fix #1400: allowing use of global cache on ECS-forwarding unless 3552 always-forward. 3553 355418 September 2017: Wouter 3555 - tag 1.6.6 (is 1.6.6rc2) 3556 - Fix that looping modules always stop the query, and don't pass 3557 control. 3558 - Fix #1435: Please allow UDP to be disabled separately upstream and 3559 downstream. 3560 - Fix #1440: [dnscrypt] client nonce cache. 3561 356215 September 2017: Wouter 3563 - Fix unbound-host to report error for DNSSEC state of failed lookups. 3564 - Spelling fixes, from Josh Soref. 3565 356613 September 2017: Wouter 3567 - tag 1.6.6rc2, became 1.6.6 on 18 sep. trunk 1.6.7 in development. 3568 356912 September 2017: Wouter 3570 - Add dns64 for client-subnet in unbound-checkconf. 3571 35724 September 2017: Ralph 3573 - Fix #1412: QNAME minimisation strict mode not honored 3574 - Fix #1434: Fix windows openssl 1.1.0 linking. 3575 35764 September 2017: Wouter 3577 - tag 1.6.6rc1 3578 - makedist fix for windows binaries, with openssl 1.1.0 windres fix, 3579 and expat 2.2.4 install target fix. 3580 35811 September 2017: Wouter 3582 - Recommend 1472 buffer size in unbound.conf 3583 358431 August 2017: Wouter 3585 - Fix #1424: cachedb:testframe is not thread safe. 3586 - For #1417: escape ; in dnscrypt tests. 3587 - but reverted that, tests fails with that escape. 3588 - Fix #1417: [dnscrypt] shared secret cache counters, and works when 3589 dnscrypt is not enabled. And cache size configuration option. 3590 - make depend 3591 - Fix #1418: [ip ratelimit] initialize slabhash using 3592 ip-ratelimit-slabs. 3593 359430 August 2017: Wouter 3595 - updated contrib/fastrpz.patch to apply with configparser changes. 3596 - Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs. 3597 359829 August 2017: Wouter 3599 - Fix #1414: fix segfault on parse failure and log_replies. 3600 - zero qinfo in handle_request, this zeroes local_alias and also the 3601 qname member. 3602 - new keys and certs for dnscrypt tests. 3603 - fixup WKS test on buildhost without servicebyname. 3604 360528 August 2017: Wouter 3606 - Fix #1415: patch to free dnscrypt environment on reload. 3607 - iana portlist update 3608 - Fix #1415: [dnscrypt] shared secret cache, patch from 3609 Manu Bretelle. 3610 - Small fixes for the shared secret cache patch. 3611 - Fix WKS records on kvm autobuild host, with default protobyname 3612 entries for udp and tcp. 3613 361423 August 2017: Wouter 3615 - Fix #1407: Add ECS options check to unbound-checkconf. 3616 - make depend 3617 - Fix to reclaim tcp handler when it is closed due to dnscrypt buffer 3618 allocation failure. 3619 362022 August 2017: Wouter 3621 - Fix install of trust anchor when two anchors are present, makes both 3622 valid. Checks hash of DS but not signature of new key. This fixes 3623 the root.key file if created when unbound is installed between 3624 sep11 and oct11 2017. 3625 - tag 1.6.5 with pointrelease 1.6.5 (1.6.4 plus 5011 fix). 3626 - trunk version 1.6.6 in development. 3627 - Fix issue on macOX 10.10 where TCP fast open is detected but not 3628 implemented causing TCP to fail. The fix allows fallback to regular 3629 TCP in this case and is also more robust for cases where connectx() 3630 fails for some reason. 3631 - Fix #1402: squelch invalid argument error for fd_set_block on windows. 3632 363310 August 2017: Wouter 3634 - Patch to show DNSCrypt status in help output, from Carsten 3635 Strotmann. 3636 36378 August 2017: Wouter 3638 - Fix #1398: make cachedb secret configurable. 3639 - Remove spaces from Makefile. 3640 36417 August 2017: Wouter 3642 - Fix #1397: Recursive DS lookups for AS112 zones names should recurse. 3643 36443 August 2017: Ralph 3645 - Remove unused iter_env member (ip6arpa_dname) 3646 - Do not reset rrset.bogus stats when called using stats_noreset. 3647 - Added stats for queries that have been ratelimited by domain 3648 recursion. 3649 - Do not add rrset_bogus and query ratelimiting stats per thread, these 3650 module stats are global. 3651 36523 August 2017: Wouter 3653 - Fix #1394: mix of serve-expired and response-ip could cause a crash. 3654 365524 July 2017: Wouter 3656 - upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02), 3657 config.sub(2016-09-05). 3658 - annotate case statement fallthrough for gcc 7.1.1. 3659 - flex output from flex 2.6.1. 3660 - snprintf of thread number does not warn about truncated string. 3661 - squelch TCP fast open error on FreeBSD when kernel has it disabled, 3662 unless verbosity is high. 3663 - remove warning from windows compile. 3664 - Fix compile with libnettle 3665 - Fix DSA configure switch (--disable dsa) for libnettle and libnss. 3666 - Fix #1365: Add Ed25519 support using libnettle. 3667 - iana portlist update 3668 366917 July 2017: Wouter 3670 - Fix #1350: make cachedb backend configurable (from JINMEI Tatuya). 3671 - Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor). 3672 With the -p option unbound does not create a pidfile. 3673 367411 July 2017: Wouter 3675 - Fix #1344: RFC6761-reserved domains: test. and invalid. 3676 - Redirect all localhost names to localhost address for RFC6761. 3677 36786 July 2017: Wouter 3679 - Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg. 3680 - Fix svn hooks for tdir (selected if testcode/mini_tdir.sh exists).. 3681 36824 July 2017: Wouter 3683 - Fix 1332: Bump verbosity of failed chown'ing of the control socket. 3684 36853 July 2017: Wouter 3686 - Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned 3687 on. 3688 - Fix #1331: libunbound segfault in threaded mode when context is 3689 deleted. 3690 - Fix pythonmod link line option flag. 3691 - Fix openssl 1.1.0 load of ssl error strings from ssl init. 3692 369329 June 2017: Wouter 3694 - Fix python example0 return module wait instead of error for pass. 3695 - iana portlist update 3696 - enhancement for hardened-tls for DNS over TLS. Removed duplicated 3697 security settings. 3698 369927 June 2017: Wouter 3700 - Tag 1.6.4 is created with the 1.6.4rc2 contents. 3701 - Trunk contains 1.6.5, with changes from 26, 27 june. 3702 - Remove signed unsigned warning from authzone. 3703 - Fix that infra cache host hash does not change after reconfig. 3704 370526 June 2017: Wouter 3706 - (for 1.6.5) 3707 Better fixup of dnscrypt_cert_chacha test for different escapes. 3708 - First fix for zero b64 and hex text zone format in sldns. 3709 - unbound-control dump_infra prints port number for address if not 53. 3710 371123 June 2017: Wouter 3712 - (for 1.6.5): fixup of dnscrypt_cert_chacha test (from Manu Bretelle). 3713 371422 June 2017: Wouter 3715 - Tag 1.6.4rc2 3716 371722 June 2017: Ralph 3718 - Added fastrpz patch to contrib 3719 372021 June 2017: Wouter 3721 - Fix #1316: heap read buffer overflow in parse_edns_options. 3722 372320 June 2017: Wouter 3724 - Fix warning in pythonmod under clang compiler. 3725 - Tag 1.6.4rc1 3726 - Fix lintian typo. 3727 372816 June 2017: Ralph 3729 - Fix #1277: disable domain ratelimit by setting value to 0. 3730 373116 June 2017: Wouter 3732 - Fix #1301: memory leak in respip and tests. 3733 - Free callback in edns-subnetmod on exit and restart. 3734 - Fix memory leak in sldns_buffer_new_frm_data. 3735 - Fix memory leak in dnscrypt config read. 3736 - Fix dnscrypt chacha cert support ifdefs. 3737 - Fix dnscrypt chacha cert unit test escapes in grep. 3738 - Remove asynclook tests that cause test and purifier problems. 3739 - Fix to unlock view in view test. 3740 374115 June 2017: Wouter 3742 - Fix stub zone queries leaking to the internet for 3743 harden-referral-path ns checks. 3744 - Fix query for refetch_glue of stub leaking to internet. 3745 374613 June 2017: Wouter 3747 - Fix #1279: Memory leak on reload when python module is enabled. 3748 - Fix #1280: Unbound fails assert when response from authoritative 3749 contains malformed qname. When 0x20 caps-for-id is enabled, when 3750 assertions are not enabled the malformed qname is handled correctly. 3751 - 1.6.3 tag created, with only #1280 fix, trunk is 1.6.4 development. 3752 - More fixes in depth for buffer checks in 0x20 qname checks. 3753 375412 June 2017: Wouter 3755 - Fix #1278: Incomplete wildcard proof. 3756 37578 June 2017: Ralph 3758 - Added domain name based ECS whitelist. 3759 37608 June 2017: Wouter 3761 - Detect chacha for dnscrypt at configure time. 3762 - dnscrypt unit tests with chacha. 3763 37647 June 2017: Wouter 3765 - Fix that unbound-control can set val_clean_additional and val_permissive_mode. 3766 - Add dnscrypt XChaCha20 tests. 3767 37686 June 2017: Wouter 3769 - Add an explicit type cast for TCP FASTOPEN fix. 3770 - renumbering B-Root's IPv6 address to 2001:500:200::b. 3771 - Fix #1275: cached data in cachedb is never used. 3772 - Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher. 3773 37741 June 2017: Ralph 3775 - Fix #1274: automatically trim chroot path from dnscrypt key/cert paths 3776 (from Manu Bretelle). 3777 37781 June 2017: Wouter 3779 - Fix fastopen EPIPE fallthrough to perform connect. 3780 378131 May 2017: Ralph 3782 - Also use global local-zones when there is a matching view that does 3783 not have any local-zone specified. 3784 378531 May 2017: Wouter 3786 - Fix #1273: cachedb.c doesn't compile with -Wextra. 3787 - If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write. 3788 378930 May 2017: Ralph 3790 - Fix #1269: inconsistent use of built-in local zones with views. 3791 - Add defaults for new local-zone trees added to views using 3792 unbound-control. 3793 379430 May 2017: Wouter 3795 - Support for openssl EVP_DigestVerify. 3796 - Support for the ED25519 algorithm with openssl (from openssl 1.1.1). 3797 379829 May 2017: Wouter 3799 - Fix assertion for low buffer size and big edns payload when worker 3800 overrides udpsize. 3801 380226 May 2017: Ralph 3803 - Added redirect-bogus.patch to contrib directory. 3804 380526 May 2017: Wouter 3806 - Fix #1270: unitauth.c doesn't compile with higher warning level 3807 and optimization 3808 - exec_prefix is by default equal to prefix. 3809 - printout localzone for duplicate local-zone warnings. 3810 381124 May 2017: Wouter 3812 - authzone cname chain, no rrset duplicates, wildcard doesn't change 3813 rrsets added for cname chain. 3814 381523 May 2017: Wouter 3816 - first services/authzone check in, it compiles and reads and writes 3817 zonefiles. 3818 - iana portlist update 3819 382022 May 2017: Wouter 3821 - Fix #1268: SIGSEGV after log_reopen. 3822 382318 May 2017: Wouter 3824 - Fix #1265 to use /bin/kill. 3825 - Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs, 3826 and compatibility with BoringSSL. 3827 382817 May 2017: Wouter 3829 - Fix #1265: contrib/unbound.service contains hardcoded path. 3830 383117 May 2017: George 3832 - Use qstate's region for IPSECKEY rrset (ipsecmod). 3833 383416 May 2017: George 3835 - Implemented opportunistic IPsec support module (ipsecmod). 3836 - Some whitespace fixup. 3837 383816 May 2017: Wouter 3839 - updated dependencies in the makefile. 3840 - document trust-anchor-signaling in example config file. 3841 - updated configure, dependencies and flex output. 3842 - better module memory lookup, fix of unbound-control shm names for 3843 module memory printout of statistics. 3844 - Fix type AVC sldns rrdef. 3845 384612 May 2017: Wouter 3847 - Adjust servfail by iterator to not store in cache when serve-expired 3848 is enabled, to avoid overwriting useful information there. 3849 - Fix queries for nameservers under a stub leaking to the internet. 3850 38519 May 2017: Ralph 3852 - Add 'c' to getopt() in testbound. 3853 - iana portlist update 3854 38558 May 2017: Wouter 3856 - Fix tcp-mss failure printout text. 3857 - Set SO_REUSEADDR on outgoing tcp connections to fix the bind before 3858 connect limited tcp connections. With the option tcp connections 3859 can share the same source port (for different destinations). 3860 38612 May 2017: Ralph 3862 - Added mesh_add_sub to add detached mesh entries. 3863 - Use mesh_add_sub for key tag signaling query. 3864 38652 May 2017: Wouter 3866 - Added test for leak of stub information. 3867 - Fix sldns wire2str printout of RR type CAA tags. 3868 - Fix sldns int16_data parse. 3869 - Fix sldns parse and printout of TSIG RRs. 3870 - sldns SMIMEA and AVC definitions, same as getdns definitions. 3871 38721 May 2017: Wouter 3873 - Fix #1259: "--disable-ecdsa" argument overwritten 3874 by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c". 3875 - iana portlist update 3876 - Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start. 3877 and fix that 64bit getting installed in C:\Program Files (x86). 3878 387926 April 2017: Ralph 3880 - Implemented trust anchor signaling using key tag query. 3881 388226 April 2017: Wouter 3883 - Based on #1257: check parse limit before t increment in sldns RR 3884 string parse routine. 3885 388624 April 2017: Wouter 3887 - unbound-checkconf -o allows query of dnstap config variables. 3888 Also unbound-control get_option. Also for dnscrypt. 3889 - trunk contains 1.6.3 version number (changes from 1.6.2 back from 3890 when the 1.6.2rc1 tag has been created). 3891 389221 April 2017: Ralph 3893 - Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle). 3894 - iana portlist update 3895 389618 April 2017: Ralph 3897 - Fix #1252: more indentation inconsistencies. 3898 - Fix #1253: unused variable in edns-subnet/addrtree.c:getbit(). 3899 390013 April 2017: Ralph 3901 - Added ECS unit test (from Manu Bretelle). 3902 - ECS documentation fix (from Manu Bretelle). 3903 390413 April 2017: Wouter 3905 - Fix #1250: inconsistent indentation in services/listen_dnsport.c. 3906 - tag for 1.6.2rc1 3907 - (for 1.6.3:) unbound.h exports the shm stats structures. They use 3908 type long long and no ifdefs, and ub_ before the typenames. 3909 391012 April 2017: Wouter 3911 - subnet mem value is available in shm, also when not enabled, 3912 to make the struct easier to memmap by other applications, 3913 independent of the configuration of unbound. 3914 391512 April 2017: Ralph 3916 - Fix #1247: unbound does not shorten source prefix length when 3917 forwarding ECS. 3918 - Properly check for allocation failure in local_data_find_tag_datas. 3919 - Fix #1249: unbound doesn't return FORMERR to bogus ECS. 3920 - Set SHM ECS memory usage to 0 when module not loaded. 3921 392211 April 2017: Ralph 3923 - Display ECS module memory usage. 3924 392510 April 2017: Wouter 3926 - harden-algo-downgrade: no also makes unbound more lenient about 3927 digest algorithms in DS records. 3928 392910 April 2017: Ralph 3930 - Remove ECS option after REFUSED answer. 3931 - Fix small memory leak in edns_opt_copy_alloc. 3932 - Respip dereference after NULL check. 3933 - Zero initialize addrtree allocation. 3934 - Use correct identifier for SHM destroy. 3935 39367 April 2017: George 3937 - Fix pythonmod for cb changes. 3938 - Some whitespace fixup. 3939 39407 April 2017: Ralph 3941 - Unlock view in respip unit test 3942 39436 April 2017: Ralph 3944 - Generalise inplace callback (de)registration 3945 - (de)register inplace callbacks for module id 3946 - No unbound-control set_option for ECS options 3947 - Deprecated client-subnet-opcode config option 3948 - Introduced client-subnet-always-forward config option 3949 - Changed max-client-subnet-ipv6 default to 56 (as in RFC) 3950 - Removed extern ECS config options 3951 - module_restart_next now calls clear on all following modules 3952 - Also create ECS module qstate on module_event_pass event 3953 - remove malloc from inplace_cb_register 3954 39556 April 2017: Wouter 3956 - Small fixup for documentation. 3957 - iana portlist update 3958 - Fix respip for braces when locks arent used. 3959 - Fix pythonmod for cb changes. 3960 39614 April 2017: Wouter 3962 - Fix #1244: document that use of chroot requires trust anchor file to 3963 be under chroot. 3964 - iana portlist update 3965 39663 April 2017: Ralph 3967 - Do not add current time twice to TTL before ECS cache store. 3968 - Do not touch rrset cache after ECS cache message generation. 3969 - Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode. 3970 39713 April 2017: Wouter 3972 - Fix #1217: Add metrics to unbound-control interface showing 3973 crypted, cert request, plaintext and malformed queries (from 3974 Manu Bretelle). 3975 - iana portlist update 3976 397727 March 2017: Wouter 3978 - Remove (now unused) event2 include from dnscrypt code. 3979 398024 March 2017: George 3981 - Fix to prevent non-referal query from being cached as referal when the 3982 no_cache_store flag was set. 3983 398423 March 2017: Wouter 3985 - Fix #1239: configure fails to find python distutils if python 3986 prints warning. 3987 398822 March 2017: Wouter 3989 - Fix #1238: segmentation fault when adding through the remote 3990 interface a per-view local zone to a view with no previous 3991 (configured) local zones. 3992 - Fix #1229: Systemd service sandboxing, options in wrong sections. 3993 399421 March 2017: Ralph 3995 - Merge EDNS Client subnet implementation from feature branch into main 3996 branch, using new EDNS processing framework. 3997 399821 March 2017: Wouter 3999 - Fix doxygen for dnscrypt files. 4000 400120 March 2017: Wouter 4002 - #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then 4003 enabled in the config file from Manu Bretelle. 4004 - make depend, autoconf, remove warnings about statement before var. 4005 - lru_demote and lruhash_insert_or_retrieve functions for getdns. 4006 - fixup for lruhash (whitespace and header file comment). 4007 - dnscrypt tests. 4008 400917 March 2017: Wouter 4010 - Patch for view functionality for local-data-ptr from Björn Ketelaars. 4011 - Fix #1237 - Wrong resolving in chain, for norec queries that get 4012 SERVFAIL returned. 4013 401416 March 2017: Wouter 4015 - Fix that SHM is not inited if not enabled. 4016 - Add trustanchor.unbound CH TXT that gets a response with a number 4017 of TXT RRs with a string like "example.com. 2345 1234" with 4018 the trust anchors and their keytags. 4019 - Fix that looped DNAMEs do not cause unbound to spend effort. 4020 - trustanchor tags are sorted. reusable routine to fetch taglist. 4021 402213 March 2017: Wouter 4023 - testbound understands Deckard MATCH rcode question answer commands. 4024 - Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead 4025 of YXDOMAIN + query loop, reported by Petr Spacek. 4026 402710 March 2017: Wouter 4028 - Fix #1234: shortening DNAME loop produces duplicate DNAME records 4029 in ANSWER section. 4030 40319 March 2017: Wouter 4032 - --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and 4033 DS records. NSEC3 is not disabled. 4034 - fake-sha1 test option; print warning if used. To make unit tests. 4035 - unbound-control list local zone and data commands listed in the 4036 help output. 4037 40388 March 2017: Wouter 4039 - make depend for build dependencies. 4040 - swig version 2.0.1 required. 4041 - fix enum conversion warnings 4042 40437 March 2017: Wouter 4044 - Fix #1230: swig version 2.0.0 is required for pythonmod, with 4045 1.3.40 it crashes when running repeatly unbound-control reload. 4046 - Response actions based on IP address from Jinmei Tatuya (Infoblox). 4047 40486 March 2017: Wouter 4049 - Fix #1229: Systemd service sandboxing in contrib/unbound.service. 4050 - iana portlist update 4051 405228 February 2017: Ralph 4053 - Fix testpkts.c, check if DO bit is set, not only if there is an OPT 4054 record. 4055 405628 February 2017: Wouter 4057 - For #1227: if we have sha256, set the cipher list to have no 4058 known vulns. 4059 406027 February 2017: Wouter 4061 - Fix #1227: Fix that Unbound control allows weak ciphersuits. 4062 - Fix #1226: provide official 32bit binary for windows. 4063 406424 February 2017: Wouter 4065 - include sys/time.h for new shm code on NetBSD. 4066 406723 February 2017: Wouter 4068 - Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to 4069 redirect. 4070 - Patch from Luiz Fernando Softov for Stats Shared Memory. 4071 - unbound-control stats_shm command prints stats using shared memory, 4072 which uses less cpu. 4073 - make depend, autoconf, doxygen and lint fixed up. 4074 407522 February 2017: Wouter 4076 - Fix #1224: Fix that defaults should not fall back to "Program Files 4077 (x86) if Unbound is 64bit by default on windows. 4078 407921 February 2017: Wouter 4080 - iana portlist update 4081 408216 February 2017: Wouter 4083 - sldns updated for vfixed and buffer resize indication from getdns. 4084 408515 February 2017: Wouter 4086 - sldns has ED25519 and ED448 algorithm number and name for display. 4087 408814 February 2017: Wouter 4089 - tag 1.6.1rc3. -- which became 1.6.1 on 21feb, trunk has 1.6.2 4090 409113 February 2017: Wouter 4092 - Fix autoconf of systemd check for lack of pkg-config. 4093 409410 February 2017: Wouter 4095 - Fix pythonmod for typedef changes. 4096 - Fix dnstap for warning of set but not used. 4097 - tag 1.6.1rc2. 4098 40999 February 2017: Wouter 4100 - tag 1.6.1rc1. 4101 41028 February 2017: Wouter 4103 - Fix for type name change and fix warning on windows compile. 4104 41057 February 2017: Wouter 4106 - Include root trust anchor id 20326 in unbound-anchor. 4107 41086 February 2017: Wouter 4109 - Fix compile on solaris of the fix to use $host detect. 4110 41114 February 2017: Wouter 4112 - fix root_anchor test for updated icannbundle.pem lower certificates. 4113 411426 January 2017: Wouter 4115 - Fix 1211: Fix can't enable interface-automatic if no IPv6 with 4116 more helpful error message. 4117 411820 January 2017: Wouter 4119 - Increase MAX_MODULE to 16. 4120 412119 January 2017: Wouter 4122 - Fix to Rename ub_callback_t to ub_callback_type, because POSIX 4123 reserves _t typedefs. 4124 - Fix to rename internally used types from _t to _type, because _t 4125 type names are reserved by POSIX. 4126 - iana portlist update 4127 412812 January 2017: Wouter 4129 - Fix to also block meta types 128 through to 248 with formerr. 4130 - Fix #1206: Some view-related commands are missing from 'unbound-control -h' 4131 41329 January 2017: Wouter 4133 - Fix #1202: Fix code comment that packed_rrset_data is not always 4134 'packed'. 4135 41366 January 2017: Wouter 4137 - Fix #1201: Fix missing unlock in answer_from_cache error condition. 4138 41395 January 2017: Wouter 4140 - Fix to return formerr for queries for meta-types, to avoid 4141 packet amplification if this meta-type is sent on to upstream. 4142 - Fix #1184: Log DNS replies. This includes the same logging 4143 information that DNS queries and response code and response size, 4144 patch from Larissa Feng. 4145 - Fix #1187: Source IP rate limiting, patch from Larissa Feng. 4146 41473 January 2017: Wouter 4148 - configure --enable-systemd and lets unbound use systemd sockets if 4149 you enable use-systemd: yes in unbound.conf. 4150 Also there are contrib/unbound.socket and contrib/unbound.service: 4151 systemd files for unbound, install them in /usr/lib/systemd/system. 4152 Contributed by Sami Kerola and Pavel Odintsov. 4153 - Fix reload chdir failure when also chrooted to that directory. 4154 41552 January 2017: Wouter 4156 - Fix #1194: Cross build fails when $host isn't `uname` for getentropy. 4157 415823 December 2016: Ralph 4159 - Fix #1190: Do not echo back EDNS options in local-zone error response. 4160 - iana portlist update 4161 416221 December 2016: Ralph 4163 - Fix #1188: Unresolved symbol 'fake_dsa' in libunbound.so when built 4164 with Nettle 4165 416619 December 2016: Ralph 4167 - Fix #1191: remove comment about view deletion. 4168 416915 December 2016: Wouter 4170 - iana portlist update 4171 - 64bit is default for windows builds. 4172 - Fix inet_ntop and inet_pton warnings in windows compile. 4173 417414 December 2016: Wouter 4175 - Fix #1178: attempt to fix setup error at end, pop result values 4176 at end of install. 4177 417813 December 2016: Wouter 4179 - Fix #1182: Fix Resource leak (socket), at startup. 4180 - Fix unbound-control and ipv6 only. 4181 41829 December 2016: Wouter 4183 - Fix #1176: stack size too small for Alpine Linux. 4184 41858 December 2016: Wouter 4186 - Fix downcast warnings from visual studio in sldns code. 4187 - tag 1.6.0rc1 which became 1.6.0 on 15 dec, and trunk is 1.6.1. 4188 41897 December 2016: Ralph 4190 - Add DSA support for OpenSSL 1.1.0 4191 - Fix remote control without cert for LibreSSL 4192 41936 December 2016: George 4194 - Added generic EDNS code for registering known EDNS option codes, 4195 bypassing the cache response stage and uniquifying mesh states. Four EDNS 4196 option lists were added to module_qstate (module_qstate.edns_opts_*) to 4197 store EDNS options from/to front/back side. 4198 - Added two flags to module_qstate (no_cache_lookup, no_cache_store) that 4199 control the modules' cache interactions. 4200 - Added code for registering inplace callback functions. The registered 4201 functions can be called just before replying with local data or Chaos, 4202 replying from cache, replying with SERVFAIL, replying with a resolved 4203 query, sending a query to a nameserver. The functions can inspect the 4204 available data and maybe change response/query related data (i.e. append 4205 EDNS options). 4206 - Updated Python module for the above. 4207 - Updated Python documentation. 4208 42095 December 2016: Ralph 4210 - Fix #1173: differ local-zone type deny from unset 4211 tag_actions element. 4212 42135 December 2016: Wouter 4214 - Fix #1170: document that 'inform' local-zone uses local-data. 4215 42161 December 2016: Ralph 4217 - hyphen as minus fix, by Andreas Schulze 4218 421930 November 2016: Ralph 4220 - Added local-zones and local-data bulk addition and removal 4221 functionality in unbound-control (local_zones, local_zones_remove, 4222 local_datas and local_datas_remove). 4223 - iana portlist update 4224 422529 November 2016: Wouter 4226 - version 1.6.0 is in the development branch. 4227 - braces in view.c around lock statements. 4228 422928 November 2016: Wouter 4230 - new install-sh. 4231 423225 November 2016: Wouter 4233 - Fix that with openssl 1.1 control-use-cert: no uses less cpu, by 4234 using no encryption over the unix socket. 4235 423622 Novenber 2016: Ralph 4237 - Make access-control-tag-data RDATA absolute. This makes the RDATA 4238 origin consistent between local-data and access-control-tag-data. 4239 - Fix NSEC ENT wildcard check. Matching wildcard does not have to be a 4240 subdomain of the NSEC owner. 4241 - QNAME minimisation uses QTYPE=A, therefore always check cache for 4242 this type in harden-below-nxdomain functionality. 4243 - Added unit test for QNAME minimisation + harden below nxdomain 4244 synergy. 4245 424622 November 2016: Wouter 4247 - iana portlist update. 4248 - Fix unit tests for DS hash processing for fake-dsa test option. 4249 - patch from Dag-Erling Smorgrav that removes code that relies 4250 on sbrk(). 4251 425221 November 2016: Wouter 4253 - Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing 4254 Underneath" for the harden-below-nxdomain option. 4255 425610 November 2016: Ralph 4257 - Fix #1155: test status code of unbound-control in 04-checkconf, 4258 not the status code from the tee command. 4259 42604 November 2016: Ralph 4261 - Added stub-ssl-upstream and forward-ssl-upstream options. 4262 42634 November 2016: Wouter 4264 - configure detects ssl security level API function in the autoconf 4265 manner. Every function on its own, so that other libraries (eg. 4266 LibreSSL) can develop their API without hindrance. 4267 - Fix #1154: segfault when reading config with duplicate zones. 4268 - Note that for harden-below-nxdomain the nxdomain must be secure, 4269 this means nsec3 with optout is insufficient. 4270 42713 November 2016: Ralph 4272 - Set OpenSSL security level to 0 when using aNULL ciphers. 4273 42743 November 2016: Wouter 4275 - .gitattributes line for githubs code language display. 4276 - log-identity: config option to set sys log identity, patch from 4277 "Robin H. Johnson" <robbat2@gentoo.org> 4278 42792 November 2016: Wouter 4280 - iana portlist update. 4281 428231 October 2016: Wouter 4283 - Fix failure to build on arm64 with no sbrk. 4284 - iana portlist update. 4285 428628 October 2016: Wouter 4287 - Patch for server.num.zero_ttl stats for count of expired replies, 4288 from Pavel Odintsov. 4289 429026 October 2016: Wouter 4291 - Fix unit tests for openssl 1.1, with no DSA, by faking DSA, enabled 4292 with the undocumented switch 'fake-dsa'. It logs a warning. 4293 429425 October 2016: Wouter 4295 - Fix #1134: unbound-control set_option -- val-override-date: -1 works 4296 immediately to ignore datetime, or back to 0 to enable it again. 4297 The -- is to ignore the '-1' as an option flag. 4298 429924 October 2016: Wouter 4300 - serve-expired config option: serve expired responses with TTL 0. 4301 - g.root-servers.net has AAAA address. 4302 430321 October 2016: Wouter 4304 - Ported tests for local_cname unit test to testbound framework. 4305 430620 October 2016: Wouter 4307 - suppress compile warning in lex files. 4308 - init lzt variable, for older gcc compiler warnings. 4309 - fix --enable-dsa to work, instead of copying ecdsa enable. 4310 - Fix DNSSEC validation of query type ANY with DNAME answers. 4311 - Fixup query_info local_alias init. 4312 431319 October 2016: Wouter 4314 - Fix #1130: whitespace in example.conf.in more consistent. 4315 431618 October 2016: Wouter 4317 - Patch that resolves CNAMEs entered in local-data conf statements that 4318 point to data on the internet, from Jinmei Tatuya (Infoblox). 4319 - Removed patch comments from acllist.c and msgencode.c 4320 - Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, 4321 from Jinmei Tatuya (Infoblox). 4322 - Fix #1125: unbound could reuse an answer packet incorrectly for 4323 clients with different EDNS parameters, from Jinmei Tatuya. 4324 - Fix #1118: libunbound.pc sets strange Libs, Libs.private values. 4325 - Added Requires line to libunbound.pc 4326 - Please doxygen by modifying mesh.h 4327 432817 October 2016: Wouter 4329 - Re-fix #839 from view commit overwrite. 4330 - Fixup const void cast warning. 4331 433212 October 2016: Ralph 4333 - Free view config elements. 4334 433511 October 2016: Ralph 4336 - Added qname-minimisation-strict config option. 4337 - iana portlist update. 4338 - fix memoryleak logfile when in debug mode. 4339 43405 October 2016: Ralph 4341 - Added views functionality. 4342 - Fix #1117: spelling errors, from Robert Edmonds. 4343 434430 September 2016: Wouter 4345 - Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav. 4346 434729 September 2016: Wouter 4348 - Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX. 4349 - Fix #839: Memory grows unexpectedly with large RPZ files. 4350 - Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile. 4351 - Fix #841: big local-zone's make it consume large amounts of memory. 4352 435327 September 2016: Wouter 4354 - tag for 1.5.10 release 4355 - trunk contains 1.5.11 in development. 4356 - Fix dnstap relaying "random" messages instead of resolver/forwarder 4357 responses, from Nikolay Edigaryev. 4358 - Fix #836: unbound could echo back EDNS options in an error response. 4359 436020 September 2016: Wouter 4361 - iana portlist update. 4362 - Fix #835: fix --disable-dsa with nettle verify. 4363 - tag for 1.5.10rc1 release. 4364 436515 September 2016: Wouter 4366 - Fix 883: error for duplicate local zone entry. 4367 - Test for openssl init_crypto and init_ssl functions. 4368 436915 September 2016: Ralph 4370 - fix potential memory leak in daemon/remote.c and nullpointer 4371 dereference in validator/autotrust. 4372 - iana portlist update. 4373 437413 September 2016: Wouter 4375 - Silenced flex-generated sign-unsigned warning print with gcc 4376 diagnostic pragma. 4377 - Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len. 4378 43799 September 2016: Wouter 4380 - Fix #831: workaround for spurious fread_chk warning against petal.c 4381 43825 September 2016: Ralph 4383 - Take configured minimum TTL into consideration when reducing TTL 4384 to original TTL from RRSIG. 4385 43865 September 2016: Wouter 4387 - Fix #829: doc of sldns_wire2str_rdata_buf() return value has an 4388 off-by-one typo, from Jinmei Tatuya (Infoblox). 4389 - Fix incomplete prototypes reported by Dag-Erling Smørgrav. 4390 - Fix #828: missing type in access-control-tag-action redirect results 4391 in NXDOMAIN. 4392 43932 September 2016: Wouter 4394 - Fix compile with openssl 1.1.0 with api=1.1.0. 4395 43961 September 2016: Wouter 4397 - RFC 7958 is now out, updated docs for unbound-anchor. 4398 - Fix for compile without warnings with openssl 1.1.0. 4399 - Fix #826: Fix refuse_non_local could result in a broken response. 4400 - iana portlist update. 4401 440229 August 2016: Wouter 4403 - Fix #777: OpenSSL 1.1.0 compatibility, patch from Sebastian A. 4404 Siewior. 4405 - Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e. 4406 440725 August 2016: Ralph 4408 - Clarify local-zone-override entry in unbound.conf.5 4409 441025 August 2016: Wouter 4411 - 64bit build option for makedist windows compile, -w64. 4412 441324 August 2016: Ralph 4414 - Fix #820: set sldns_str2wire_rr_buf() dual meaning len parameter 4415 in each iteration in find_tag_datas(). 4416 - unbound.conf.5 entries for define-tag, access-control-tag, 4417 access-control-tag-action, access-control-tag-data, local-zone-tag, 4418 and local-zone-override. 4419 442023 August 2016: Wouter 4421 - Fix #804: unbound stops responding after outage. Fixes queries 4422 that attempt to wait for an empty list of subqueries. 4423 - Fix #804: lower num_target_queries for iterator also for failed 4424 lookups. 4425 44268 August 2016: Wouter 4427 - Note that OPENPGPKEY type is RFC 7929. 4428 44294 August 2016: Wouter 4430 - Fix #807: workaround for possible some "unused" function parameters 4431 in test code, from Jinmei Tatuya. 4432 44333 August 2016: Wouter 4434 - use sendmsg instead of sendto for TFO. 4435 443628 July 2016: Wouter 4437 - Fix #806: wrong comment removed. 4438 443926 July 2016: Wouter 4440 - nicer ratelimit-below-domain explanation. 4441 444222 July 2016: Wouter 4443 - Fix #801: missing error condition handling in 4444 daemon_create_workers(). 4445 - Fix #802: workaround for function parameters that are "unused" 4446 without log_assert. 4447 - Fix #803: confusing (and incorrect) code comment in daemon_cleanup(). 4448 444920 July 2016: Wouter 4450 - Fix typo in unbound.conf. 4451 445218 July 2016: Wouter 4453 - Fix #798: Client-side TCP fast open fails (Linux). 4454 445514 July 2016: Wouter 4456 - TCP Fast open patch from Sara Dickinson. 4457 - Fixed unbound.doxygen for 1.8.11. 4458 44597 July 2016: Wouter 4460 - access-control-tag-data implemented. verbose(4) prints tag debug. 4461 44625 July 2016: Wouter 4463 - Fix dynamic link of anchor-update.exe on windows. 4464 - Fix detect of mingw for MXE package build. 4465 - Fixes for 64bit windows compile. 4466 - Fix #788 for nettle 3.0: Failed to build with Nettle >= 3.0 and 4467 --with-libunbound-only --with-nettle. 4468 44694 July 2016: Wouter 4470 - For #787: prefer-ip6 option for unbound.conf prefers to send 4471 upstream queries to ipv6 servers. 4472 - Fix #787: outgoing-interface netblock/64 ipv6 option to use linux 4473 freebind to use 64bits of entropy for every query with random local 4474 part. 4475 447630 June 2016: Wouter 4477 - Document always_transparent, always_refuse, always_nxdomain types. 4478 447929 June 2016: Wouter 4480 - Fix static compile on windows missing gdi32. 4481 448228 June 2016: Wouter 4483 - Create a pkg-config file for libunbound in contrib. 4484 448527 June 2016: Wouter 4486 - Fix #784: Build configure assumess that having getpwnam means there 4487 is endpwent function available. 4488 - Updated repository with newer flex and bison output. 4489 449024 June 2016: Ralph 4491 - Possibility to specify local-zone type for an acl/tag pair 4492 - Possibility to specify (override) local-zone type for a source address 4493 block 449416 June 2016: Ralph 4495 - Decrease dp attempts at each QNAME minimisation iteration 4496 449716 June 2016: Wouter 4498 - Fix tcp timeouts in tv.usec. 4499 450015 June 2016: Wouter 4501 - TCP_TIMEOUT is specified in milliseconds. 4502 - If more than half of tcp connections are in use, a shorter timeout 4503 is used (200 msec, vs 2 minutes) to pressure tcp for new connects. 4504 450514 June 2016: Ralph 4506 - QNAME minimisation unit test for dropped QTYPE=A queries. 4507 450814 June 2016: Wouter 4509 - Fix 775: unbound-host and unbound-anchor crash on windows, ignore 4510 null delete for wsaevent. 4511 - Fix spelling in freebind option man page text. 4512 - Fix windows link of ssl with crypt32. 4513 - Fix 779: Union casting is non-portable. 4514 - Fix 780: MAP_ANON not defined in HP-UX 11.31. 4515 - Fix 781: prealloc() is an HP-UX system library call. 4516 451713 June 2016: Ralph 4518 - Use QTYPE=A for QNAME minimisation. 4519 - Keep track of number of time-outs when performing QNAME minimisation. 4520 Stop minimising when number of time-outs for a QNAME/QTYPE pair is 4521 more than three. 4522 452313 June 2016: Wouter 4524 - Fix #778: unbound 1.5.9: -h segfault (null deref). 4525 - Fix directory: fix for unbound-checkconf, it restores cwd. 4526 452710 June 2016: Wouter 4528 - And delete service.conf.shipped on uninstall. 4529 - In unbound.conf directory: dir immediately changes to that directory, 4530 so that include: file below that is relative to that directory. 4531 With chroot, make the directory an absolute path inside chroot. 4532 - keep debug symbols in windows build. 4533 - do not delete service.conf on windows uninstall. 4534 - document directory immediate fix and allow EXECUTABLE syntax in it 4535 on windows. 4536 45379 June 2016: Wouter 4538 - Trunk is called 1.5.10 (with previous fixes already in there to 2 4539 june). 4540 - Revert fix for NetworkService account on windows due to breakage 4541 it causes. 4542 - Fix that windows install will not overwrite existing service.conf 4543 file (and ignore gui config choices if it exists). 4544 45457 June 2016: Ralph 4546 - Lookup localzones by taglist from acl. 4547 - Possibility to lookup local_zone, regardless the taglist. 4548 - Added local_zone/taglist/acl unit test. 4549 45507 June 2016: Wouter 4551 - Fix #773: Non-standard Python location build failure with pyunbound. 4552 - Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures. 4553 45546 June 2016: Wouter 4555 - Better help text from -h (from Ray Griffith). 4556 - access-control-tag config directive. 4557 - local-zone-override config directive. 4558 - access-control-tag-action and access-control-tag-data config 4559 directives. 4560 - free acl-tags, acltag-action and acltag-data config lists during 4561 initialisation to free up memory for more entries. 4562 45633 June 2016: Wouter 4564 - Fix to not ignore return value of chown() in daemon startup. 4565 45662 June 2016: Wouter 4567 - Fix libubound for edns optlist feature. 4568 - Fix distinction between free and CRYPTO_free in dsa and ecdsa alloc. 4569 - Fix #752: retry resource temporarily unavailable on control pipe. 4570 - un-document localzone tags. 4571 - tag for release 1.5.9rc1. 4572 And this also became release 1.5.9. 4573 - Fix (for 1.5.10): Fix unbound-anchor.exe file location defaults to 4574 Program Files with (x86) appended. 4575 - re-documented localzone tags in example.conf. 4576 457731 May 2016: Wouter 4578 - Fix windows service to be created run with limited rights, as a 4579 network service account, from Mario Turschmann. 4580 - compat strsep implementation. 4581 - generic edns option parse and store code. 4582 - and also generic edns options for upstream messages (and replies). 4583 after parse use edns_opt_find(edns.opt_list, LDNS_EDNS_NSID), 4584 to insert use edns_opt_append(edns, region, code, len, bindata) on 4585 the opt_list passed to send_query, or in edns_opt_inplace_reply. 4586 458730 May 2016: Wouter 4588 - Fix time in case answer comes from cache in ub_resolve_event(). 4589 - Attempted fix for #765: _unboundmodule missing for python3. 4590 459127 May 2016: Wouter 4592 - Fix #770: Small subgroup attack on DH used in unix pipe on localhost 4593 if unbound control uses a unix local named pipe. 4594 - Document write permission to directory of trust anchor needed. 4595 - Fix #768: Unbound Service Sometimes Can Not Shutdown 4596 Completely, WER Report Shown Up. Close handle before closing WSA. 4597 459826 May 2016: Wouter 4599 - Updated patch from Charles Walker. 4600 460124 May 2016: Wouter 4602 - disable-dnssec-lame-check config option from Charles Walker. 4603 - remove memory leak from lame-check patch. 4604 - iana portlist update. 4605 460623 May 2016: Wouter 4607 - Fix #767: Reference to an expired Internet-Draft in 4608 harden-below-nxdomain documentation. 4609 461020 May 2016: Ralph 4611 - No QNAME minimisation fall-back for NXDOMAIN answers from DNSSEC 4612 signed zones. 4613 - iana portlist update. 4614 461519 May 2016: Wouter 4616 - Fix #766: dns64 should synthesize results on timeout/errors. 4617 461818 May 2016: Wouter 4619 - Fix #761: DNSSEC LAME false positive resolving nic.club. 4620 462117 May 2016: Wouter 4622 - trunk updated with output of flex 2.6.0. 4623 46246 May 2016: Wouter 4625 - Fix memory leak in out-of-memory conditions of local zone add. 4626 462729 April 2016: Wouter 4628 - Fix sldns with static checking fixes copied from getdns. 4629 463028 April 2016: Wouter 4631 - Fix #759: 0x20 capsforid no longer checks type PTR, for 4632 compatibility with cisco dns guard. This lowers false positives. 4633 463418 April 2016: Wouter 4635 - Fix some malformed responses to edns queries get fallback to nonedns. 4636 463715 April 2016: Wouter 4638 - cachedb module event handling design. 4639 464014 April 2016: Wouter 4641 - cachedb module framework (empty). 4642 - iana portlist update. 4643 464412 April 2016: Wouter 4645 - Fix #753: document dump_requestlist is for first thread. 4646 464724 March 2016: Wouter 4648 - Document permit-small-holddown for 5011 debug. 4649 - Fix #749: unbound-checkconf gets SIGSEGV when use against a 4650 malformatted conf file. 4651 465223 March 2016: Wouter 4653 - OpenSSL 1.1.0 portability, --disable-dsa configure option. 4654 465521 March 2016: Wouter 4656 - Fix compile of getentropy_linux for SLES11 servicepack 4. 4657 - Fix dnstap-log-resolver-response-messages, from Nikolay Edigaryev. 4658 - Fix test for openssl to use HMAC_Update for 1.1.0. 4659 - acx_nlnetlabs.m4 to v33, with HMAC_Update. 4660 - acx_nlnetlabs.m4 to v34, with -ldl -pthread test for libcrypto. 4661 - ERR_remove_state deprecated since openssl 1.0.0. 4662 - OPENSSL_config is deprecated, removing. 4663 466418 March 2016: Ralph 4665 - Validate QNAME minimised NXDOMAIN responses. 4666 - If QNAME minimisation is enabled, do cache lookup for QTYPE NS in 4667 harden-below-nxdomain. 4668 466917 March 2016: Ralph 4670 - Limit number of QNAME minimisation iterations. 4671 467217 March 2016: Wouter 4673 - Fix #746: Fix unbound sets CD bit on all forwards. 4674 If no trust anchors, it'll not set CD bit when forwarding to another 4675 server. If a trust anchor, no CD bit on the first attempt to a 4676 forwarder, but CD bit thereafter on repeated attempts to get DNSSEC. 4677 - iana portlist update. 4678 467916 March 2016: Wouter 4680 - Fix ip-transparent for ipv6 on FreeBSD, thanks to Nick Hibma. 4681 - Fix ip-transparent for tcp on freebsd. 4682 468315 March 2016: Wouter 4684 - ip_freebind: yesno option in unbound.conf sets IP_FREEBIND for 4685 binding to an IP address while the interface or address is down. 4686 468714 March 2016: Wouter 4688 - Fix warnings in ifdef corner case, older or unknown libevent. 4689 - Fix compile for ub_event code with older libev. 4690 469111 March 2016: Wouter 4692 - Remove warning about unused parameter in event_pluggable.c. 4693 - Fix libev usage of dispatch return value. 4694 - No side effects in tolower() call, in case it is a macro. 4695 - For test put free in pluggable api in parenthesis. 4696 469710 March 2016: Wouter 4698 - Fixup backend2str for libev. 4699 470009 March 2016: Willem 4701 - User defined pluggable event API for libunbound 4702 - Fixup of compile fix for pluggable event API from P.Y. Adi 4703 Prasaja. 4704 470509 March 2016: Wouter 4706 - Updated configure and ltmain.sh. 4707 - Updated L root IPv6 address. 4708 470907 March 2016: Wouter 4710 - Fix #747: assert in outnet_serviced_query_stop. 4711 - iana ports fetched via https. 4712 - iana portlist update. 4713 471403 March 2016: Wouter 4715 - configure tests for the weak attribute support by the compiler. 4716 471702 March 2016: Wouter 4718 - 1.5.8 release tag 4719 - trunk contains 1.5.9 in development. 4720 - iana portlist update. 4721 - Fix #745: unbound.py - idn2dname throws UnicodeError when idnname 4722 contains trailing dot. 4723 472424 February 2016: Wouter 4725 - Fix OpenBSD asynclook lock free that gets used later (fix test code). 4726 - Fix that NSEC3 negative cache is used when there is no salt. 4727 472823 February 2016: Wouter 4729 - ub_ctx_set_stub() function for libunbound to config stub zones. 4730 - sorted ubsyms.def file with exported libunbound functions. 4731 473219 February 2016: Wouter 4733 - Print understandable debug log when unusable DS record is seen. 4734 - load gost algorithm if digest is seen before key algorithm. 4735 - iana portlist update. 4736 473717 February 2016: Wouter 4738 - Fix that "make install" fails due to "text file busy" error. 4739 474016 February 2016: Wouter 4741 - Set IPPROTO_IP6 for ipv6 sockets otherwise invalid argument error. 4742 474315 February 2016: Wouter 4744 - ip-transparent option for FreeBSD with IP_BINDANY socket option. 4745 - wait for sendto to drain socket buffers when they are full. 4746 47479 February 2016: Wouter 4748 - Test for type OPENPGPKEY. 4749 - insecure-lan-zones: yesno config option, patch from Dag-Erling 4750 Smørgrav. 4751 47528 February 2016: Wouter 4753 - Fix patch typo in prevuous commit for 734 from Adi Prasaja. 4754 - RR Type CSYNC support RFC 7477, in debug printout and config input. 4755 - RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07). 4756 475729 January 2016: Wouter 4758 - Neater cmdline_verbose increment patch from Edgar Pettijohn. 4759 476027 January 2016: Wouter 4761 - Made netbsd sendmsg test nonfatal, in case of false positives. 4762 - Fix #741: log message for dnstap socket connection is more clear. 4763 476426 January 2016: Wouter 4765 - Fix #734: chown the pidfile if it resides inside the chroot. 4766 - Use arc4random instead of random in tests (because it is 4767 available, possibly as compat, anyway). 4768 - Fix cmsg alignment for argument to sendmsg on NetBSD. 4769 - Fix that unbound complains about unimplemented IP_PKTINFO for 4770 sendmsg on NetBSD (for interface-automatic). 4771 477225 January 2016: Wouter 4773 - Fix #738: Swig should not be invoked with CPPFLAGS. 4774 477519 January 2016: Wouter 4776 - Squelch 'cannot assign requested address' log messages unless 4777 verbosity is high, it was spammed after network down. 4778 477914 January 2016: Wouter 4780 - Fix to simplify empty string checking from Michael McConville. 4781 - iana portlist update. 4782 478312 January 2016: Wouter 4784 - Fix #734: Do not log an error when the PID file cannot be chown'ed. 4785 Patch from Simon Deziel. 4786 478711 January 2016: Wouter 4788 - Fix test if -pthreads unused to use better grep for portability. 4789 479006 January 2016: Wouter 4791 - Fix mingw crosscompile for recent mingw. 4792 - Update aclocal, autoconf output with new versions (1.15, 2.4.6). 4793 479405 January 2016: Wouter 4795 - #731: tcp-mss, outgoing-tcp-mss options for unbound.conf, patch 4796 from Daisuke Higashi. 4797 - Support RFC7686: handle ".onion" Special-Use Domain. It is blocked 4798 by default, and can be unblocked with "nodefault" localzone config. 4799 480004 January 2016: Wouter 4801 - Define DEFAULT_SOURCE together with BSD_SOURCE when that is defined, 4802 for Linux glibc 2.20. 4803 - Fixup contrib/aaaa-filter-iterator.patch for moved contents in the 4804 source code, so it applies cleanly again. Removed unused variable 4805 warnings. 4806 480715 December 2015: Ralph 4808 - Fix #729: omit use of escape sequences in echo since they are not 4809 portable (unbound-control-setup). 4810 481111 December 2015: Wouter 4812 - remove NULL-checks before free, patch from Michael McConville. 4813 - updated ax_pthread.m4 to version 21 with clang support, this 4814 removes a warning from compilation. 4815 - OSX portability, detect if sbrk is deprecated. 4816 - OSX clang, stop -pthread unused during link stage warnings. 4817 - OSX clang new flto check. 4818 481910 December 2015: Wouter 4820 - 1.5.7 release 4821 - trunk has 1.5.8 in development. 4822 48238 December 2015: Wouter 4824 - Fixup 724 for unbound-control. 4825 48267 December 2015: Ralph 4827 - Do not minimise forwarded requests. 4828 48294 December 2015: Wouter 4830 - Removed unneeded whitespace from example.conf. 4831 48323 December 2015: Ralph 4833 - (after rc1 tag) 4834 - Committed fix to qname minimisation and unit test case for it. 4835 48363 December 2015: Wouter 4837 - iana portlist update. 4838 - 1.5.7rc1 prerelease tag. 4839 48402 December 2015: Wouter 4841 - Fixup 724: Fix PCA prompt for unbound-service-install.exe. 4842 re-enable stdout printout. 4843 - For 724: Add Changelog to windows binary dist. 4844 48451 December 2015: Ralph 4846 - Qname minimisation review fixes 4847 48481 December 2015: Wouter 4849 - Fixup 724 fix for fname_after_chroot() calls. 4850 - Remove stdout printout for unbound-service-install.exe 4851 - .gitignore for git users. 4852 485330 November 2015: Ralph 4854 - Implemented qname minimisation 4855 485630 November 2015: Wouter 4857 - Fix for #724: conf syntax to read files from run dir (on Windows). 4858 485925 November 2015: Wouter 4860 - Fix for #720, fix unbound-control-setup windows batch file. 4861 486224 November 2015: Wouter 4863 - Fix #720: add windows scripts to zip bundle. 4864 - iana portlist update. 4865 486620 November 2015: Wouter 4867 - Added assert on rrset cache correctness. 4868 - Fix that malformed EDNS query gets a response without malformed EDNS. 4869 487018 November 2015: Wouter 4871 - newer acx_nlnetlabs.m4. 4872 - spelling fixes from Igor Sobrado Delgado. 4873 487417 November 2015: Wouter 4875 - Fix #594. libunbound: optionally use libnettle for crypto. 4876 Contributed by Luca Bruno. Added --with-nettle for use with 4877 --with-libunbound-only. 4878 - refactor nsec3 hash implementation to be more library-portable. 4879 - iana portlist update. 4880 - Fixup DER encoded DSA signatures for libnettle. 4881 488216 November 2015: Wouter 4883 - Fix for lenient accept of reverse order DNAME and CNAME. 4884 48856 November 2015: Wouter 4886 - Change example.conf: ftp.internic.net to https://www.internic.net 4887 48885 November 2015: Wouter 4889 - ACX_SSL_CHECKS no longer adds -ldl needlessly. 4890 48913 November 2015: Wouter 4892 - Fix #718: Fix unbound-control-setup with support for env 4893 without HEREDOC bash support. 4894 489529 October 2015: Wouter 4896 - patch from Doug Hogan for SSL_OP_NO_SSLvx options. 4897 - Fix #716: nodata proof with empty non-terminals and wildcards. 4898 489928 October 2015: Wouter 4900 - Fix checklock testcode for linux threads on exit. 4901 490227 October 2015: Wouter 4903 - isblank() compat implementation. 4904 - detect libexpat without xml_StopParser function. 4905 - portability fixes. 4906 - portability, replace snprintf if return value broken. 4907 490823 October 2015: Wouter 4909 - Fix #714: Document config to block private-address for IPv4 4910 mapped IPv6 addresses. 4911 491222 October 2015: Wouter 4913 - Fix #712: unbound-anchor appears to not fsync root.key. 4914 491520 October 2015: Wouter 4916 - 1.5.6 release. 4917 - trunk tracks development of 1.5.7. 4918 491915 October 2015: Wouter 4920 - Fix segfault in the dns64 module in the formaterror error path. 4921 - Fix sldns_wire2str_rdata_scan for malformed RRs. 4922 - tag for 1.5.6rc1 release. 4923 492414 October 2015: Wouter 4925 - ANY responses include DNAME records if present, as per Evan Hunt's 4926 remark in dnsop. 4927 - Fix manpage to suggest using SIGTERM to terminate the server. 4928 49299 October 2015: Wouter 4930 - Default for ssl-port is port 853, the temporary port assignment 4931 for secure domain name system traffic. 4932 If you used to rely on the older default of port 443, you have 4933 to put a clause in unbound.conf for that. The new value is likely 4934 going to be the standardised port number for this traffic. 4935 - iana portlist update. 4936 49376 October 2015: Wouter 4938 - 1.5.5 release. 4939 - trunk tracks the development of 1.5.6. 4940 494128 September 2015: Wouter 4942 - MAX_TARGET_COUNT increased to 64, to fix up sporadic resolution 4943 failures. 4944 - tag for 1.5.5rc1 release. 4945 - makedist.sh: pgp sig echo commands. 4946 494725 September 2015: Wouter 4948 - Fix unbound-control flush that does not succeed in removing data. 4949 495022 September 2015: Wouter 4951 - Fix config globbed include chroot treatment, this fixes reload of 4952 globs (patch from Dag-Erling Smørgrav). 4953 - iana portlist update. 4954 - Fix #702: New IPs for for h.root-servers.net. 4955 - Remove confusion comment from canonical_compare() function. 4956 - Fix #705: ub_ctx_set_fwd() return value mishandled on windows. 4957 - testbound selftest also works in non-debug mode. 4958 - Fix minor error in unbound.conf.5.in 4959 - Fix unbound.conf(5) access-control description for precedence 4960 and default. 4961 496231 August 2015: Wouter 4963 - changed windows setup compression to be more transparent. 4964 496528 August 2015: Wouter 4966 - Fix #697: Get PY_MAJOR_VERSION failure at configure for python 4967 2.4 to 2.6. 4968 - Feature #699: --enable-pie option to that builds PIE binary. 4969 - Feature #700: --enable-relro-now option that enables full read-only 4970 relocation. 4971 497224 August 2015: Wouter 4973 - Fix deadlock for local data add and zone add when unbound-control 4974 list_local_data printout is interrupted. 4975 - iana portlist update. 4976 - Change default of harden-algo-downgrade to off. This is lenient 4977 for algorithm rollover. 4978 497913 August 2015: Wouter 4980 - 5011 implementation does not insist on all algorithms, when 4981 harden-algo-downgrade is turned off. 4982 - Reap the child process that libunbound spawns. 4983 498411 August 2015: Wouter 4985 - Fix #694: configure script does not detect LibreSSL 2.2.2 4986 49874 August 2015: Wouter 4988 - Document that local-zone nodefault matches exactly and transparent 4989 can be used to release a subzone. 4990 49913 August 2015: Wouter 4992 - Document in the manual more text about configuring locally served 4993 zones. 4994 - Fix 5011 anchor update timer after reload. 4995 - Fix mktime in unbound-anchor not using UTC. 4996 499730 July 2015: Wouter 4998 - please afl-gcc (llvm) for uninitialised variable warning. 4999 - Added permit-small-holddown config to debug fast 5011 rollover. 5000 500124 July 2015: Wouter 5002 - Fix #690: Reload fails when so-reuseport is yes after changing 5003 num-threads. 5004 - iana portlist update. 5005 500621 July 2015: Wouter 5007 - Fix configure to detect SSL_CTX_set_ecdh_auto. 5008 - iana portlist update. 5009 501020 July 2015: Wouter 5011 - Enable ECDHE for servers. Where available, use 5012 SSL_CTX_set_ecdh_auto() for TLS-wrapped server configurations to 5013 enable ECDHE. Otherwise, manually offer curve p256. 5014 Client connections should automatically use ECDHE when available. 5015 (thanks Daniel Kahn Gillmor) 5016 501718 July 2015: Willem 5018 - Allow certificate chain files to allow for intermediate certificates. 5019 (thanks Daniel Kahn Gillmor) 5020 502113 July 2015: Wouter 5022 - makedist produces sha1 and sha256 files for created binaries too. 5023 50249 July 2015: Wouter 5025 - 1.5.4 release tag 5026 - trunk has 1.5.5 in development. 5027 - Fix #681: Setting forwarders with unbound-control forward 5028 implicitly turns on forward-first. 5029 503029 June 2015: Wouter 5031 - iana portlist update. 5032 - Fix alloc with log for allocation size checks. 5033 503426 June 2015: Wouter 5035 - Fix #677 Fix DNAME responses from cache that failed internal chain 5036 test. 5037 - iana portlist update. 5038 503922 June 2015: Wouter 5040 - Fix #677 Fix CNAME corresponding to a DNAME was checked incorrectly 5041 and was therefore always synthesized (thanks to Valentin Dietrich). 5042 50434 June 2015: Wouter 5044 - RFC 7553 RR type URI support, is now enabled by default. 5045 50462 June 2015: Wouter 5047 - Fix #674: Do not free pointers given by getenv. 5048 504929 May 2015: Wouter 5050 - Fix that unparseable error responses are ratelimited. 5051 - SOA negative TTL is capped at minimumttl in its rdata section. 5052 - cache-max-negative-ttl config option, default 3600. 5053 505426 May 2015: Wouter 5055 - Document that ratelimit works with unbound-control set_option. 5056 505721 May 2015: Wouter 5058 - iana portlist update. 5059 - documentation proposes ratelimit of 1000 (closer to what upstream 5060 servers expect from us). 5061 506220 May 2015: Wouter 5063 - DLV is going to be decommissioned. Advice to stop using it, and 5064 put text in the example configuration and man page to that effect. 5065 506610 May 2015: Wouter 5067 - Change syntax of particular validator error to be easier for 5068 machine parse, swap rrset and ip adres info so it looks like: 5069 validation failure <www.example.nl. TXT IN>: signature crypto 5070 failed from 2001:DB8:7:bba4::53 for <*.example.nl. NSEC IN> 5071 50721 May 2015: Wouter 5073 - caps-whitelist in unbound.conf allows whitelist of loadbalancers 5074 that cannot work with caps-for-id or its fallback. 5075 507630 April 2015: Wouter 5077 - Unit test for type ANY synthesis. 5078 507922 April 2015: Wouter 5080 - Removed contrib/unbound_unixsock.diff, because it has been 5081 integrated, use control-interface: /path in unbound.conf. 5082 - iana portlist update. 5083 508417 April 2015: Wouter 5085 - Synthesize ANY responses from cache. Does not search exhaustively, 5086 but MX,A,AAAA,SOA,NS also CNAME. 5087 - Fix leaked dns64prefix configuration string. 5088 508916 April 2015: Wouter 5090 - Add local-zone type inform_deny, that logs query and drops answer. 5091 - Ratelimit does not apply to prefetched queries, and ratelimit-factor 5092 is default 10. Repeated normal queries get resolved and with 5093 prefetch stay in the cache. 5094 - Fix bug#664: libunbound python3 related fixes (from Tomas Hozza) 5095 Use print_function also for Python2. 5096 libunbound examples: produce sorted output. 5097 libunbound-Python: libldns is not used anymore. 5098 Fix issue with Python 3 mapping of FILE* using file_py3.i from ldns. 5099 510010 April 2015: Wouter 5101 - unbound-control ratelimit_list lists high rate domains. 5102 - ratelimit feature, ratelimit: 100, or some sensible qps, can be 5103 used to turn it on. It ratelimits recursion effort per zone. 5104 For particular names you can configure exceptions in unbound.conf. 5105 - Fix that get_option for cache-sizes does not print double newline. 5106 - Fix#663: ssl handshake fails when using unix socket because dh size 5107 is too small. 5108 51098 April 2015: Wouter 5110 - Fix crash in dnstap: Do not try to log TCP responses after timeout. 5111 51127 April 2015: Wouter 5113 - Libunbound skips dos-line-endings from etc/hosts. 5114 - Unbound exits with a fatal error when the auto-trust-anchor-file 5115 fails to be writable. This is seconds after startup. You can 5116 load a readonly auto-trust-anchor-file with trust-anchor-file. 5117 The file has to be writable to notice the trust anchor change, 5118 without it, a trust anchor change will be unnoticed and the system 5119 will then become inoperable. 5120 - unbound-control list_insecure command shows the negative trust 5121 anchors currently configured, patch from Jelte Jansen. 5122 51232 April 2015: Wouter 5124 - Fix #660: Fix interface-automatic broken in the presence of 5125 asymmetric routing. 5126 512726 March 2015: Wouter 5128 - remote.c probedelay line is easier to read. 5129 - rename ldns subdirectory to sldns to avoid name collision. 5130 513125 March 2015: Wouter 5132 - Fix #657: libunbound(3) recommends deprecated 5133 CRYPTO_set_id_callback. 5134 - If unknown trust anchor algorithm, and libressl is used, error 5135 message encourages upgrade of the libressl package. 5136 513723 March 2015: Wouter 5138 - Fix segfault on user not found at startup (from Maciej Soltysiak). 5139 514020 March 2015: Wouter 5141 - Fixed to add integer overflow checks on allocation (defense in depth). 5142 514319 March 2015: Wouter 5144 - Add ip-transparent config option for bind to non-local addresses. 5145 514617 March 2015: Wouter 5147 - Use reallocarray for integer overflow protection, patch submitted 5148 by Loganaden Velvindron. 5149 515016 March 2015: Wouter 5151 - Fixup compile on cygwin, more portable openssl thread id. 5152 515312 March 2015: Wouter 5154 - Updated default keylength in unbound-control-setup to 3k. 5155 515610 March 2015: Wouter 5157 - Fix lintian warning in unbound-checkconf man page (from Andreas 5158 Schulze). 5159 - print svnroot when building windows dist. 5160 - iana portlist update. 5161 - Fix warning on sign compare in getentropy_linux. 5162 51639 March 2015: Wouter 5164 - Fix #644: harden-algo-downgrade option, if turned off, fixes the 5165 reported excessive validation failure when multiple algorithms 5166 are present. It allows the weakest algorithm to validate the zone. 5167 - iana portlist update. 5168 51695 March 2015: Wouter 5170 - contrib/unbound_smf22.tar.gz: Solaris SMF installation/removal 5171 scripts. Contributed by Yuri Voinov. 5172 - Document that incoming-num-tcp increase is good for large servers. 5173 - stats reports tcp usage, of incoming-num-tcp buffers. 5174 51754 March 2015: Wouter 5176 - Patch from Brad Smith that syncs compat/getentropy_linux with 5177 OpenBSD's version (2015-03-04). 5178 - 0x20 fallback improved: servfail responses do not count as missing 5179 comparisons (except if all responses are errors), 5180 inability to find nameservers does not fail equality comparisons, 5181 many nameservers does not try to compare more than max-sent-count, 5182 parse failures start 0x20 fallback procedure. 5183 - store caps_response with best response in case downgrade response 5184 happens to be the last one. 5185 - Document windows 8 tests. 5186 51873 March 2015: Wouter 5188 - tag 1.5.3rc1 5189 [ This became 1.5.3 on 10 March, trunk is 1.5.4 in development ] 5190 51912 March 2015: Wouter 5192 - iana portlist update. 5193 519420 February 2015: Wouter 5195 - Use the getrandom syscall introduced in Linux 3.17 (from Heiner 5196 Kallweit). 5197 - Fix #645 Portability to Solaris 10, use AF_LOCAL. 5198 - Fix #646 Portability to Solaris, -lrt for getentropy_solaris. 5199 - Fix #647 crash in 1.5.2 because pwd.db no longer accessible after 5200 reload. 5201 520219 February 2015: Wouter 5203 - 1.5.2 release tag. 5204 - svn trunk contains 1.5.3 under development. 5205 520613 February 2015: Wouter 5207 - Fix #643: doc/example.conf.in: unnecessary whitespace. 5208 520912 February 2015: Wouter 5210 - tag 1.5.2rc1 5211 521211 February 2015: Wouter 5213 - iana portlist update. 5214 521510 February 2015: Wouter 5216 - Fix scrubber with harden-glue turned off to reject NS (and other 5217 not-address) records. 5218 52199 February 2015: Wouter 5220 - Fix validation failure in case upstream forwarder (ISC BIND) does 5221 not have the same trust anchors and decides to insert unsigned NS 5222 record in authority section. 5223 52242 February 2015: Wouter 5225 - infra-cache-min-rtt patch from Florian Riehm, for expected long 5226 uplink roundtrip times. 5227 522830 January 2015: Wouter 5229 - Fix 0x20 capsforid fallback to omit gratuitous NS and additional 5230 section changes. 5231 - Portability fix for Solaris ('sun' is not usable for a variable). 5232 523329 January 2015: Wouter 5234 - Fix pyunbound byte string representation for python3. 5235 523626 January 2015: Wouter 5237 - Fix unintended use of gcc extension for incomplete enum types, 5238 compile with pedantic c99 compliance (from Daniel Dickman). 5239 524023 January 2015: Wouter 5241 - windows port fixes, no AF_LOCAL, no chown, no chmod(grp). 5242 524316 January 2015: Wouter 5244 - unit test for local unix connection. Documentation and log_addr 5245 does not inspect port for AF_LOCAL. 5246 - unbound-checkconf -f prints chroot with pidfile path. 5247 524813 January 2015: Wouter 5249 - iana portlist update. 5250 525112 January 2015: Wouter 5252 - Cast sun_len sizeof to socklen_t. 5253 - Fix pyunbound ord call, portable for python 2 and 3. 5254 52557 January 2015: Wouter 5256 - Fix warnings in pythonmod changes. 5257 52586 January 2015: Wouter 5259 - iana portlist update. 5260 - patch for remote control over local sockets, from Dag-Erling 5261 Smorgrav, Ilya Bakulin. Use control-interface: /path/sock and 5262 control-use-cert: no. 5263 - Fixup that patch and uid lookup (only for daemon). 5264 - coded the default of control-use-cert, to yes. 5265 52665 January 2015: Wouter 5267 - getauxval test for ppc64 linux compatibility. 5268 - make strip works for unbound-host and unbound-anchor. 5269 - patch from Stephane Lapie that adds to the python API, that 5270 exposes struct delegpt, and adds the find_delegation function. 5271 - print query name when max target count is exceeded. 5272 - patch from Stuart Henderson that fixes DESTDIR in 5273 unbound-control-setup for installs where config is not in 5274 the prefix location. 5275 - Fix #634: fix fail to start on Linux LTS 3.14.X, ignores missing 5276 IP_MTU_DISCOVER OMIT option (fix from Remi Gacogne). 5277 - Updated contrib warmup.cmd/sh to support two modes - load 5278 from pre-defined list of domains or (with filename as argument) 5279 load from user-specified list of domains, and updated contrib 5280 unbound_cache.sh/cmd to support loading/save/reload cache to/from 5281 default path or (with secondary argument) arbitrary path/filename, 5282 from Yuri Voinov. 5283 - Patch from Philip Paeps to contrib/unbound_munin_ that uses 5284 type ABSOLUTE. Allows munin.conf: [idleserver.example.net] 5285 unbound_munin_hits.graph_period minute 5286 52879 December 2014: Wouter 5288 - svn trunk has 1.5.2 in development. 5289 - config.guess and config.sub update from libtoolize. 5290 - local-zone: example.com inform makes unbound log a message with 5291 client IP for queries in that zone. Eg. for finding infected hosts. 5292 52938 December 2014: Wouter 5294 - Fix CVE-2014-8602: denial of service by making resolver chase 5295 endless series of delegations. 5296 52971 December 2014: Wouter 5298 - Fix bug#632: unbound fails to build on AArch64, protects 5299 getentropy compat code from calling sysctl if it is has been removed. 5300 530129 November 2014: Wouter 5302 - Add include to getentropy_linux.c, hopefully fixing debian build. 5303 530428 November 2014: Wouter 5305 - Fix makefile for build from noexec source tree. 5306 530726 November 2014: Wouter 5308 - Fix libunbound undefined symbol errors for main. 5309 Referencing main does not seem to be possible for libunbound. 5310 531124 November 2014: Wouter 5312 - Fix log at high verbosity and memory allocation failure. 5313 - iana portlist update. 5314 531521 November 2014: Wouter 5316 - Fix crash on multiple thread random usage on systems without 5317 arc4random. 5318 531920 November 2014: Wouter 5320 - fix compat/getentropy_win.c check if CryptGenRandom works and no 5321 immediate exit on windows. 5322 532319 November 2014: Wouter 5324 - Fix cdflag dns64 processing. 5325 532618 November 2014: Wouter 5327 - Fix that CD flag disables DNS64 processing, returning the DNSSEC 5328 signed AAAA denial. 5329 - iana portlist update. 5330 533117 November 2014: Wouter 5332 - Fix #627: SSL_CTX_load_verify_locations return code not properly 5333 checked. 5334 533514 November 2014: Wouter 5336 - parser with bison 2.7 5337 533813 November 2014: Wouter 5339 - Patch from Stephane Lapie for ASAHI Net that implements aaaa-filter, 5340 added to contrib/aaaa-filter-iterator.patch. 5341 534212 November 2014: Wouter 5343 - trunk has 1.5.1 in development. 5344 - Patch from Robert Edmonds to build pyunbound python module 5345 differently. No versioninfo, with -shared and without $(LIBS). 5346 - Patch from Robert Edmonds fixes hyphens in unbound-anchor man page. 5347 - Removed 'increased limit open files' log message that is written 5348 to console. It is only written on verbosity 4 and higher. 5349 This keeps system bootup console cleaner. 5350 - Patch from James Raftery, always print stats for rcodes 0..5. 5351 535211 November 2014: Wouter 5353 - iana portlist update. 5354 - Fix bug where forward or stub addresses with same address but 5355 different port number were not tried. 5356 - version number in svn trunk is 1.5.0 5357 - tag 1.5.0rc1 5358 - review fix from Ralph. 5359 53607 November 2014: Wouter 5361 - dnstap fixes by Robert Edmonds: 5362 dnstap/dnstap.m4: cosmetic fixes 5363 dnstap/: Remove compiled protoc-c output files 5364 dnstap/dnstap.m4: Error out if required libraries are not found 5365 dnstap: Fix ProtobufCBufferSimple usage that is incorrect as of 5366 protobuf-c 1.0.0 5367 dnstap/: Adapt to API changes in latest libfstrm (>= 0.2.0) 5368 53694 November 2014: Wouter 5370 - Add ub_ctx_add_ta_autr function to add a RFC5011 automatically 5371 tracked trust anchor to libunbound. 5372 - Redefine internal minievent symbols to unique symbols that helps 5373 linking on platforms where the linker leaks names across modules. 5374 537527 October 2014: Wouter 5376 - Disabled use of SSLv3 in remote-control and ssl-upstream. 5377 - iana portlist update. 5378 537916 October 2014: Wouter 5380 - Documented dns64 configuration in unbound.conf man page. 5381 538213 October 2014: Wouter 5383 - Fix #617: in ldns in unbound, lowercase WKS services. 5384 - Fix ctype invocation casts. 5385 538610 October 2014: Wouter 5387 - Fix unbound-checkconf check for module config with dns64 module. 5388 - Fix unbound capsforid fallback, it ignores TTLs in comparison. 5389 53906 October 2014: Wouter 5391 - Fix #614: man page variable substitution bug. 53926 October 2014: Willem 5393 - Whitespaces after $ORIGIN are not part of the origin dname (ldns). 5394 - $TTL's value starts at position 5 (ldns). 5395 53961 October 2014: Wouter 5397 - fix #613: Allow tab ws in var length last rdfs (in ldns str2wire). 5398 539929 September 2014: Wouter 5400 - Fix #612: create service with service.conf in present directory and 5401 auto load it. 5402 - Fix for mingw compile openssl ranlib. 5403 540425 September 2014: Wouter 5405 - updated configure and aclocal with newer autoconf 1.13. 5406 540722 September 2014: Wouter 5408 - Fix swig and python examples for Python 3.x. 5409 - Fix for mingw compile with openssl-1.0.1i. 5410 541119 September 2014: Wouter 5412 - improve python configuration detection to build on Fedora 22. 5413 541418 September 2014: Wouter 5415 - patches to also build with Python 3.x (from Pavel Simerda). 5416 541716 September 2014: Wouter 5418 - Fix tcp timer waiting list removal code. 5419 - iana portlist update. 5420 - Updated the TCP_BACLOG from 5 to 256, so that the tcp accept queue 5421 is longer and more tcp connections can be handled. 5422 542315 September 2014: Wouter 5424 - Fix unit test for CDS typecode. 5425 54265 September 2014: Wouter 5427 - type CDS and CDNSKEY types in sldns. 5428 542925 August 2014: Wouter 5430 - Fixup checklock code for log lock and its mutual initialization 5431 dependency. 5432 - iana portlist update. 5433 - Removed necessity for pkg-config from the dnstap.m4, new are 5434 the --with-libfstrm and --with-protobuf-c configure options. 5435 543619 August 2014: Wouter 5437 - Update unbound manpage with more explanation (from Florian Obser). 5438 543918 August 2014: Wouter 5440 - Fix #603: unbound-checkconf -o <option> should skip verification 5441 checks. 5442 - iana portlist update. 5443 - Fixup doc/unbound.doxygen to remove obsolete 1.8.7 settings. 5444 54455 August 2014: Wouter 5446 - dnstap support, with a patch from Farsight Security, written by 5447 Robert Edmonds. The --enable-dnstap needs libfstrm and protobuf-c. 5448 It is BSD licensed (see dnstap/dnstap.c). 5449 Building with --enable-dnstap needs pkg-config with this patch. 5450 - Noted dnstap in doc/README and doc/CREDITS. 5451 - Changes to the dnstap patch. 5452 - lint fixes. 5453 - dnstap/dnstap_config.h should not have been added to the repo, 5454 because is it generated. 5455 54561 August 2014: Wouter 5457 - Patch add msg, rrset, infra and key cache sizes to stats command 5458 from Maciej Soltysiak. 5459 - iana portlist update. 5460 546131 July 2014: Wouter 5462 - DNS64 from Viagenie (BSD Licensed), written by Simon Perrault. 5463 Initial commit of the patch from the FreeBSD base (with its fixes). 5464 This adds a module (for module-config in unbound.conf) dns64 that 5465 performs DNS64 processing, see README.DNS64. 5466 - Changes from DNS64: 5467 strcpy changed to memmove. 5468 arraybound check fixed from prefix_net/8/4 to prefix_net/8+4. 5469 allocation of result consistently in the correct region. 5470 time_t is now used for ttl in unbound (since the patch's version). 5471 - testdata/dns64_lookup.rpl for unit test for dns64 functionality. 5472 547329 July 2014: Wouter 5474 - Patch from Dag-Erling Smorgrav that implements feature, unbound -dd 5475 does not fork in the background and also logs to stderr. 5476 547721 July 2014: Wouter 5478 - Fix endian.h include for OpenBSD. 5479 548016 July 2014: Wouter 5481 - And Fix#596: Bail out of unbound-control dump_infra when ssl 5482 write fails. 5483 548415 July 2014: Wouter 5485 - Fix #596: Bail out of unbound-control list_local_zones when ssl 5486 write fails. 5487 - iana portlist update. 5488 548913 July 2014: Wouter 5490 - Configure tests if main can be linked to from getentropy compat. 5491 549212 July 2014: Wouter 5493 - Fix getentropy compat code, function refs were not portable. 5494 - Fix to check openssl version number only for OpenSSL. 5495 - LibreSSL provides compat items, check for that in configure. 5496 - Fix bug in fix for log locks that caused deadlock in signal handler. 5497 - update compat/getentropy and arc4random to the most recent ones from OpenBSD. 5498 549911 July 2014: Matthijs 5500 - fake-rfc2553 patch (thanks Benjamin Baier). 5501 550211 July 2014: Wouter 5503 - arc4random in compat/ and getentropy, explicit_bzero, chacha for 5504 dependencies, from OpenBSD. arc4_lock and sha512 in compat. 5505 This makes arc4random available on all platforms, except when 5506 compiled with LIBNSS (it uses libNSS crypto random). 5507 - fix strptime implicit declaration error on OpenBSD. 5508 - arc4random, getentropy and explicit_bzero compat for Windows. 5509 55104 July 2014: Wouter 5511 - Fix #593: segfault or crash upon rotating logfile. 5512 55133 July 2014: Wouter 5514 - DLV tests added. 5515 - signit tool fixup for compile with libldns library. 5516 - iana portlist updated. 5517 551827 June 2014: Wouter 5519 - so-reuseport is available on BSDs(such as FreeBSD 10) and OS/X. 5520 552126 June 2014: Wouter 5522 - unbound-control status reports if so-reuseport was successful. 5523 - iana portlist updated. 5524 552524 June 2014: Wouter 5526 - Fix caps-for-id fallback, and added fallback attempt when servers 5527 drop 0x20 perturbed queries. 5528 - Fixup testsetup for VM tests (run testcode/run_vm.sh). 5529 553017 June 2014: Wouter 5531 - iana portlist updated. 5532 55333 June 2014: Wouter 5534 - Add AAAA for B root server to default root hints. 5535 55362 June 2014: Wouter 5537 - Remove unused define from iterator.h 5538 553930 May 2014: Wouter 5540 - Fixup sldns_enum_edns_option typedef definition. 5541 554228 May 2014: Wouter 5543 - Code cleanup patch from Dag-Erling Smorgrav, with compiler issue 5544 fixes from FreeBSD's copy of Unbound, he notes: 5545 Generate unbound-control-setup.sh at build time so it respects 5546 prefix and sysconfdir from the configure script. Also fix the 5547 umask to match the comment, and the comment to match the umask. 5548 Add const and static where needed. Use unions instead of 5549 playing pointer poker. Move declarations that are needed in 5550 multiple source files into a shared header. Move sldns_bgetc() 5551 from parse.c to buffer.c where it belongs. Introduce a new 5552 header file, worker.h, which declares the callbacks that 5553 all workers must define. Remove those declarations from 5554 libworker.h. Include the correct headers in the correct places. 5555 Fix a few dummy callbacks that don't match their prototype. 5556 Fix some casts. Hide the sbrk madness behind #ifdef HAVE_SBRK. 5557 Remove a useless printf which breaks reproducible builds. 5558 Get rid of CONFIGURE_{TARGET,DATE,BUILD_WITH} now that they're 5559 no longer used. Add unbound-control-setup.sh to the list of 5560 generated files. The prototype for libworker_event_done_cb() 5561 needs to be moved from libunbound/libworker.h to 5562 libunbound/worker.h. 5563 - Fixup out-of-directory compile with unbound-control-setup.sh.in. 5564 - make depend. 5565 556623 May 2014: Wouter 5567 - unbound-host -D enabled dnssec and reads root trust anchor from 5568 the default root key file that was compiled in. 5569 557020 May 2014: Wouter 5571 - Feature, unblock-lan-zones: yesno that you can use to make unbound 5572 perform 10.0.0.0/8 and other reverse lookups normally, for use if 5573 unbound is running service for localhost on localhost. 5574 557516 May 2014: Wouter 5576 - Updated create_unbound_ad_servers and unbound_cache scripts from 5577 Yuri Voinov in the source/contrib directory. Added 5578 warmup.cmd (and .sh): warm up the DNS cache with your MRU domains. 5579 55809 May 2014: Wouter 5581 - Implement draft-ietf-dnsop-rfc6598-rfc6303-01. 5582 - iana portlist updated. 5583 55848 May 2014: Wouter 5585 - Contrib windows scripts from Yuri Voinov added to src/contrib: 5586 create_unbound_ad_servers.cmd: enters anti-ad server lists. 5587 unbound_cache.cmd: saves and loads the cache. 5588 - Added unbound-control-setup.cmd from Yuri Voinov to the windows 5589 unbound distribution set. It requires openssl installed in %PATH%. 5590 55916 May 2014: Wouter 5592 - Change MAX_SENT_COUNT from 16 to 32 to resolve some cases easier. 5593 55945 May 2014: Wouter 5595 - More #567: remove : from output of stub and forward lists, this is 5596 easier to parse. 5597 559829 April 2014: Wouter 5599 - iana portlist updated. 5600 - Add unbound-control flush_negative that flushed nxdomains, nodata, 5601 and errors from the cache. For dnssec-trigger and NetworkManager, 5602 fixes cases where network changes have localdata that was already 5603 negatively cached from the previous network. 5604 560523 April 2014: Wouter 5606 - Patch from Jeremie Courreges-Anglas to use arc4random_uniform 5607 if available on the OS, it gets entropy from the OS. 5608 560915 April 2014: Wouter 5610 - Fix compile with libevent2 on FreeBSD. 5611 561211 April 2014: Wouter 5613 - Fix #502: explain that do-ip6 disable does not stop AAAA lookups, 5614 but it stops the use of the ipv6 transport layer for DNS traffic. 5615 - iana portlist updated. 5616 561710 April 2014: Wouter 5618 - iana portlist updated. 5619 - Patch from Hannes Frederic Sowa for Linux 3.15 fragmentation 5620 option for DNS fragmentation defense. 5621 - Document that dump_requestlist only prints queries from thread 0. 5622 - unbound-control stats prints num.query.tcpout with number of TCP 5623 outgoing queries made in the previous statistics interval. 5624 - Fix #567: unbound lists if forward zone is secure or insecure with 5625 +i annotation in output of list_forwards, also for list_stubs 5626 (for NetworkManager integration.) 5627 - Fix #554: use unsigned long to print 64bit statistics counters on 5628 64bit systems. 5629 - Fix #558: failed prefetch lookup does not remove cached response 5630 but delays next prefetch (in lieu of caching a SERVFAIL). 5631 - Fix #545: improved logging, the ip address of the error is printed 5632 on the same log-line as the error. 5633 56348 April 2014: Wouter 5635 - Fix #574: make test fails on Ubuntu 14.04. Disabled remote-control 5636 in testbound scripts. 5637 - iana portlist updated. 5638 56397 April 2014: Wouter 5640 - C.ROOT-SERVERS.NET has an IPv6 address, and we updated the root 5641 hints (patch from Anand Buddhdev). 5642 - Fix #572: Fix unit test failure for systems with different 5643 /etc/services. 5644 564528 March 2014: Wouter 5646 - Fix #569: do_tcp is do-tcp in unbound.conf man page. 5647 564825 March 2014: Wouter 5649 - Patch from Stuart Henderson to build unbound-host man from .1.in. 5650 565124 March 2014: Wouter 5652 - Fix print filename of encompassing config file on read failure. 5653 565412 March 2014: Wouter 5655 - tag 1.4.22 5656 - trunk has 1.4.23 in development. 5657 565810 March 2014: Wouter 5659 - Fix bug#561: contrib/cacti plugin did not report SERVFAIL rcodes 5660 because of spelling. Patch from Chris Coates. 5661 566227 February 2014: Wouter 5663 - tag 1.4.22rc1 5664 566521 February 2014: Wouter 5666 - iana portlist updated. 5667 566820 February 2014: Matthijs 5669 - Be lenient when a NSEC NameError response with RCODE=NXDOMAIN is 5670 received. This is okay according 4035, but not after revising 5671 existence in 4592. NSEC empty non-terminals exist and thus the 5672 RCODE should have been NOERROR. If this occurs, and the RRsets 5673 are secure, we set the RCODE to NOERROR and the security status 5674 of the response is also considered secure. 5675 567614 February 2014: Wouter 5677 - Works on Minix (3.2.1). 5678 567911 February 2014: Wouter 5680 - Fix parse of #553(NSD) string in sldns, quotes without spaces. 5681 56827 February 2014: Wouter 5683 - iana portlist updated. 5684 - add body to ifstatement if locks disabled. 5685 - add TXT string"string" test case to unit test. 5686 - Fix #551: License change "Regents" to "Copyright holder", matching 5687 the BSD license on opensource.org. 5688 56896 February 2014: Wouter 5690 - sldns has type HIP. 5691 - code documentation on the module interface. 5692 56935 February 2014: Wouter 5694 - Fix sldns parse tests on osx. 5695 56963 February 2014: Wouter 5697 - Detect libevent2 install automatically by configure. 5698 - Fixup link with lib/event2 subdir. 5699 - Fix parse in sldns of quoted parenthesized text strings. 5700 570131 January 2014: Wouter 5702 - unit test for ldns wire to str and back with zones, root, nlnetlabs 5703 and types.sidnlabs. 5704 - Fix for hex to string in unknown, atma and nsap. 5705 - fixup nss compile (no ldns in it). 5706 - fixup warning in unitldns 5707 - fixup WKS and rdata type service to print unsigned because strings 5708 are not portable; they cannot be read (for sure) on other computers. 5709 - fixup type EUI48 and EUI64, type APL and type IPSECKEY in string 5710 parse sldns. 5711 571230 January 2014: Wouter 5713 - delay-close does not act if there are udp-wait queries, so that 5714 it does not make a socketdrain DoS easier. 5715 571628 January 2014: Wouter 5717 - iana portlist updated. 5718 - iana portlist test updated so it does not touch the source 5719 if there are no changes. 5720 - delay-close: msec option that delays closing ports for which 5721 the UDP reply has timed out. Keeps the port open, only accepts 5722 the correct reply. This correct reply is not used, but the port 5723 is open so that no port-denied ICMPs are generated. 5724 572527 January 2014: Wouter 5726 - reuseport is attempted, then fallback to without on failure. 5727 572824 January 2014: Wouter 5729 - Change unbound-event.h to use void* buffer, length idiom. 5730 - iana portlist updated. 5731 - unbound-event.h is installed if you configure --enable-event-api. 5732 - speed up unbound (reports say it could be up to 10%), by reducing 5733 lock contention on localzones.lock. It is changed to an rwlock. 5734 - so-reuseport: yesno option to distribute queries evenly over 5735 threads on Linux (Thanks Robert Edmonds). 5736 - made lint clean. 5737 573821 January 2014: Wouter 5739 - Fix #547: no trustanchor written if filesystem full, fclose checked. 5740 574117 January 2014: Wouter 5742 - Fix isprint() portability in sldns, uses unsigned int. 5743 - iana portlist updated. 5744 574516 January 2014: Wouter 5746 - fix #544: Fixed +i causes segfault when running with module conf 5747 "iterator". 5748 - Windows port, adjust %lld to %I64d, and warning in win_event.c. 5749 575014 January 2014: Wouter 5751 - iana portlist updated. 5752 57535 Dec 2013: Wouter 5754 - Fix bug in cachedump that uses sldns. 5755 - update pythonmod for ldns_ to sldns_ name change. 5756 57573 Dec 2013: Wouter 5758 - Fix sldns to use sldns_ prefix for all ldns_ variables. 5759 - Fix windows compile to compile with sldns. 5760 576130 Nov 2013: Wouter 5762 - Fix sldns to make globals use sldns_ prefix. This fixes 5763 linking with libldns that uses global variables ldns_ . 5764 576513 Nov 2013: Wouter 5766 - Fix bug#537: compile python plugin without ldns library. 5767 576812 Nov 2013: Wouter 5769 - Fix bug#536: acl_deny_non_local and refuse_non_local added. 5770 57715 Nov 2013: Wouter 5772 - Patch from Neel Goyal to fix async id assignment if callback 5773 is called by libunbound in the mesh attach. 5774 - Accept ip-address: as an alternative for interface: for 5775 consistency with nsd.conf syntax. 5776 57774 Nov 2013: Wouter 5778 - Patch from Neel Goyal to fix callback in libunbound. 5779 57803 Nov 2013: Wouter 5781 - if configured --with-libunbound-only fix make install. 5782 578331 Oct 2013: Wouter 5784 - Fix #531: Set SO_REUSEADDR so that the wildcard interface and a 5785 more specific interface port 53 can be used at the same time, and 5786 one of the daemons is unbound. 5787 - iana portlist update. 5788 - separate ldns into core ldns inside ldns/ subdirectory. No more 5789 --with-ldns is needed and unbound does not rely on libldns. 5790 - portability fixes for new USE_SLDNS ldns subdir codebase. 5791 579222 Oct 2013: Wouter 5793 - Patch from Neel Goyal: Add an API call to set an event base on an 5794 existing ub_ctx. This basically just destroys the current worker and 5795 sets the event base to the current. And fix a deadlock in 5796 ub_resolve_event – the cfglock is held when libworker_create is 5797 called. This ends up trying to acquire the lock again in 5798 context_obtain_alloc in the call chain. 5799 - Fix #528: if very high logging (4 or more) segfault on allow_snoop. 5800 580126 Sep 2013: Wouter 5802 - unbound-event.h is installed if configured --with-libevent. It 5803 contains low-level library calls, that use libevent's event_base 5804 and an ldns_buffer for the wire return packet to perform async 5805 resolution in the client's eventloop. 5806 580719 Sep 2013: Wouter 5808 - 1.4.21 tag created. 5809 - trunk has 1.4.22 number inside it. 5810 - iana portlist updated. 5811 - acx_nlnetlabs.m4 to 26; improve FLTO help text. 5812 581316 Sep 2013: Wouter 5814 - Fix#524: max-udp-size not effective to non-EDNS0 queries, from 5815 Daisuke HIGASHI. 5816 581710 Sep 2013: Wouter 5818 - MIN_TTL and MAX_TTL also in time_t. 5819 - tag 1.4.21rc1 made again. 5820 582126 Aug 2013: Wouter 5822 - More fixes for bug#519: for the threaded case test if the bg 5823 thread has been killed, on ub_ctx_delete, to avoid hangs. 5824 582522 Aug 2013: Wouter 5826 - more fixes that I overlooked. 5827 - review fixes from Willem. 5828 582921 Aug 2013: Wouter 5830 - Fix#520: Errors found by static analysis from Tomas Hozza(redhat). 5831 583220 Aug 2013: Wouter 5833 - Fix for 2038, with time_t instead of uint32_t. 5834 583519 Aug 2013: Wouter 5836 - Fix#519 ub_ctx_delete may hang in some scenarios (libunbound). 5837 583814 Aug 2013: Wouter 5839 - Fix uninit variable in fix#516. 5840 58418 Aug 2013: Wouter 5842 - Fix#516 dnssec lameness detection for answers that are improper. 5843 584430 Jun 2013: Wouter 5845 - tag 1.4.21rc1 5846 584729 Jun 2013: Wouter 5848 - Fix#512 memleak in testcode for testbound (if it fails). 5849 - Fix#512 NSS returned arrays out of setup function to be statics. 5850 585126 Jun 2013: Wouter 5852 - max include of 100.000 files (depth and globbed at one time). 5853 This is to preserve system memory in bug cases, or endless cases. 5854 - iana portlist updated. 5855 585619 Jun 2013: Wouter 5857 - streamtcp man page, contributed by Tomas Hozza. 5858 - iana portlist updated. 5859 - libunbound documentation on how to avoid openssl race conditions. 5860 586125 Jun 2013: Wouter 5862 - Squelch sendto-permission denied errors when the network is 5863 not connected, to avoid spamming syslog. 5864 - configure --disable-flto option (from Robert Edmonds). 5865 586618 Jun 2013: Wouter 5867 - Fix for const string literals in C++ for libunbound, from Karel 5868 Slany. 5869 - iana portlist updated. 5870 587117 Jun 2013: Wouter 5872 - Fixup manpage syntax. 5873 587414 Jun 2013: Wouter 5875 - get_option and set_option support for log-time-ascii, python-script 5876 val-sig-skew-min and val-sig-skew-max. log-time-ascii takes effect 5877 immediately. The others are mostly useful for libunbound users. 5878 587913 Jun 2013: Wouter 5880 - get_option, set_option, unbound-checkconf -o and libunbound 5881 getoption and setoption support cache-min-ttl and cache-max-ttl. 5882 588310 Jun 2013: Wouter 5884 - Fix#501: forward-first does not recurse, when forward name is ".". 5885 - iana portlist update. 5886 - Max include depth is unlimited. 5887 588827 May 2013: Wouter 5889 - Update acx_pthreads.m4 to ax_pthreads.4 (2013-03-29), and apply 5890 patch to it to not fail when -Werror is also specified, from the 5891 autoconf-archives. 5892 - iana portlist update. 5893 589421 May 2013: Wouter 5895 - Explain bogus and secure flags in libunbound more. 5896 589716 May 2013: Wouter 5898 - Fix#499 use-after-free in out-of-memory handling code (thanks Jake 5899 Montgomery). 5900 - Fix#500 use on non-initialised values on socket bind failures. 5901 590215 May 2013: Wouter 5903 - Fix round-robin doesn't work with some Windows clients (from Ilya 5904 Bakulin). 5905 59063 May 2013: Wouter 5907 - update acx_nlnetlabs.m4 to v23, sleep w32 fix. 5908 590926 April 2013: Wouter 5910 - add unbound-control insecure_add and insecure_remove for the 5911 administration of negative trust anchors. 5912 591325 April 2013: Wouter 5914 - Implement max-udp-size config option, default 4096 (thanks 5915 Daisuke Higashi). 5916 - Robust checks on dname validity from rdata for dname compare. 5917 - updated iana portlist. 5918 591919 April 2013: Wouter 5920 - Fixup snprintf return value usage, fixed libunbound_get_option. 5921 592218 April 2013: Wouter 5923 - fix bug #491: pick program name (0th argument) as syslog identity. 5924 - own implementation of compat/snprintf.c. 5925 592615 April 2013: Wouter 5927 - Fix so that for a configuration line of include: "*.conf" it is not 5928 an error if there are no files matching the glob pattern. 5929 - unbound-anchor review: BIO_write can return 0 successfully if it 5930 has successfully appended a zero length string. 5931 593211 April 2013: Wouter 5933 - Fix queries leaking up for stubs and forwards, if the configured 5934 nameservers all fail to answer. 5935 593610 April 2013: Wouter 5937 - code improve for minimal responses, small speed increase. 5938 59399 April 2013: Wouter 5940 - updated iana portlist. 5941 - Fix crash in previous private address fixup of 22 March. 5942 594328 March 2013: Wouter 5944 - Make reverse zones easier by documenting the nodefault statements 5945 commented-out in the example config file. 5946 594726 March 2013: Wouter 5948 - more fixes to lookup3.c endianness detection. 5949 595025 March 2013: Wouter 5951 - #492: Fix endianness detection, revert to older lookup3.c detection 5952 and put new detect lines after previous tests, to avoid regressions 5953 but allow new detections to succeed. 5954 And add detection for machine/endian.h to it. 5955 595622 March 2013: Wouter 5957 - Fix resolve of names that use a mix of public and private addresses. 5958 - iana portlist update. 5959 - Fix makedist for new svn for -d option. 5960 - unbound.h header file has UNBOUND_VERSION_MAJOR define. 5961 - Fix windows RSRC version for long version numbers. 5962 596321 March 2013: Wouter 5964 - release 1.4.20 5965 - trunk has 1.4.21 5966 - committed libunbound version 4:1:2 for binary API updated in 1.4.20 5967 - install copy of unbound-control.8 man page for unbound-control-setup 5968 596914 March 2013: Wouter 5970 - iana portlist update. 5971 - tag 1.4.20rc1 5972 597312 March 2013: Wouter 5974 - Fixup makedist.sh for windows compile. 5975 597611 March 2013: Wouter 5977 - iana portlist update. 5978 - testcode/ldns-testpkts.c check for makedist is informational. 5979 598015 February 2013: Wouter 5981 - fix defines in lookup3 for bigendian bsd alpha 5982 598311 February 2013: Wouter 5984 - Fixup openssl_thread init code to only run if compiled with SSL. 5985 59867 February 2013: Wouter 5987 - detect endianness in lookup3 on BSD. 5988 - add libunbound.ttl at end of result structure, version bump for 5989 libunbound and binary backwards compatible, but 1.4.19 is not 5990 forward compatible with 1.4.20. 5991 - update iana port list. 5992 599330 January 2013: Wouter 5994 - includes and have_ssl fixes for nss. 5995 599629 January 2013: Wouter 5997 - printout name of zone with duplicate fwd and hint errors. 5998 599928 January 2013: Wouter 6000 - updated fwd_zero for newer nc. Updated common.sh for newer netstat. 6001 600217 January 2013: Wouter 6003 - unbound-anchors checks the emailAddress of the signer of the 6004 root.xml file, default is dnssec@iana.org. It also checks that 6005 the signer has the correct key usage for a digital signature. 6006 - update iana port list. 6007 60083 January 2013: Wouter 6009 - Test that unbound-control checks client credentials. 6010 - Test that unbound can handle a CNAME at an intermediate node in 6011 the chain of trust (where it seeks a DS record). 6012 - Check the commonName of the signer of the root.xml file in 6013 unbound-anchor, default is dnssec@iana.org. 6014 60152 January 2013: Wouter 6016 - Fix openssl lock free on exit (reported by Robert Fleischman). 6017 - iana portlist updated. 6018 - Tested that unbound implements the RFC5155 Technical Errata id 3441. 6019 Unbound already implements insecure classification of an empty 6020 nonterminal in NSEC3 optout zone. 6021 602220 December 2012: Wouter 6023 - Fix unbound-anchor xml parse of entity declarations for safety. 6024 602519 December 2012: Wouter 6026 - iana portlist updated. 6027 602818 December 2012: Wouter 6029 - iana portlist updated. 6030 603114 December 2012: Wouter 6032 - Change of D.ROOT-SERVERS.NET A address in default root hints. 6033 603412 December 2012: Wouter 6035 - 1.4.19 release. 6036 - trunk has 1.4.20 under development. 6037 60385 December 2012: Wouter 6039 - note support for AAAA RR type RFC. 6040 60414 December 2012: Wouter 6042 - 1.4.19rc1 tag. 6043 604430 November 2012: Wouter 6045 - bug 481: fix python example0. 6046 - iana portlist updated. 6047 604827 November 2012: Wouter 6049 - iana portlist updated. 6050 60519 November 2012: Wouter 6052 - Fix unbound-control forward disables configured stubs below it. 6053 60547 November 2012: Wouter 6055 - Fixup ldns-testpkts, identical to ldns/examples. 6056 - iana portlist updated. 6057 605830 October 2012: Wouter 6059 - Fix bug #477: unbound-anchor segfaults if EDNS is blocked. 6060 606129 October 2012: Matthijs 6062 - Fix validation for responses with both CNAME and wildcard 6063 expanded CNAME records in answer section. 6064 60658 October 2012: Wouter 6066 - update ldns-testpkts.c to ldns 1.6.14 version. 6067 - fix build of pythonmod in objdir, for unbound.py. 6068 - make clean and makerealclean remove generated python and docs. 6069 60705 October 2012: Wouter 6071 - fix build of pythonmod in objdir (thanks Jakob Schlyter). 6072 60733 October 2012: Wouter 6074 - fix text in unbound-anchor man page. 6075 60761 October 2012: Wouter 6077 - ignore trusted-keys globs that have no files (from Paul Wouters). 6078 607927 September 2012: Wouter 6080 - include: directive in config file accepts wildcards. Patch from 6081 Paul Wouters. Suggested use: include: "/etc/unbound.d/conf.d/*" 6082 - unbound-control -q option is quiet, patch from Mariano Absatz. 6083 - iana portlist updated. 6084 - updated contrib/unbound.spec, patch from Valentin Bud. 6085 608621 September 2012: Wouter 6087 - chdir to / after chroot call (suggested by Camiel Dobbelaar). 6088 608917 September 2012: Wouter 6090 - patch_rsamd5_enable.diff: this patch enables RSAMD5 validation 6091 otherwise it is treated as insecure. The RSAMD5 algorithm is 6092 deprecated (RFC6725). The MD5 hash is considered weak for some 6093 purposes, if you want to sign your zone, then RSASHA256 is an 6094 uncontested hash. 6095 609630 August 2012: Wouter 6097 - RFC6725 deprecates RSAMD5: this DNSKEY algorithm is disabled. 6098 - iana portlist updated. 6099 610029 August 2012: Wouter 6101 - Nicer comments outgoing-port-avoid, thanks Stu (bug #465). 6102 610322 August 2012: Wouter 6104 - Fallback to 1472 and 1232, one fragment size without headers. 6105 610621 August 2012: Wouter 6107 - Fix timeouts so that when a server has been offline for a while 6108 and is probed to see it works, it becomes fully available for 6109 server selection again. 6110 611117 August 2012: Wouter 6112 - Add documentation to libunbound for default nonuse of resolv.conf. 6113 61142 August 2012: Wouter 6115 - trunk has 1.4.19 under development (fixes from 1 aug and 31 july 6116 are for 1.4.19). 6117 - iana portlist updated. 6118 61191 August 2012: Wouter 6120 - Fix openssl race condition, initializes openssl locks, reported 6121 by Einar Lonn and Patrik Wallstrom. 6122 612331 July 2012: Wouter 6124 - Improved forward-first and stub-first documentation. 6125 - Fix that enables modules to register twice for the same 6126 serviced_query, without race conditions or administration issues. 6127 This should not happen with the current codebase, but it is robust. 6128 - Fix forward-first option where it sets the RD flag wrongly. 6129 - added manpage links for libunbound calls (Thanks Paul Wouters). 6130 613130 July 2012: Wouter 6132 - tag 1.4.18rc2 (became 1.4.18 release at 2 august 2012). 6133 613427 July 2012: Wouter 6135 - unbound-host works with libNSS 6136 - fix bogus nodata cname chain not reported as bogus by validator, 6137 (Thanks Peter van Dijk). 6138 613926 July 2012: Wouter 6140 - iana portlist updated. 6141 - tag 1.4.18rc1. 6142 614325 July 2012: Wouter 6144 - review fix for libnss, check hash prefix allocation size. 6145 614623 July 2012: Wouter 6147 - fix missing break for GOST DS hash function. 6148 - implemented forward_first for the root. 6149 615020 July 2012: Wouter 6151 - Fix bug#452 and another assertion failure in mesh.c, makes 6152 assertions in mesh.c resist duplicates. Fixes DS NS search to 6153 not generate duplicate sub queries. 6154 615519 July 2012: Willem 6156 - Fix bug#454: Remove ACX_CHECK_COMPILER_FLAG from configure.ac, 6157 if CFLAGS is specified at configure time then '-g -O2' is not 6158 appended to CFLAGS, so that the user can override them. 6159 616018 July 2012: Willem 6161 - Fix libunbound report of errors when in background mode. 6162 616311 July 2012: Willem 6164 - updated iana ports list. 6165 61669 July 2012: Willem 6167 - Add flush_bogus option for unbound-control 6168 61696 July 2012: Wouter 6170 - Fix validation of qtype DS queries that result in no data for 6171 non-optout NSEC3 zones. 6172 61734 July 2012: Wouter 6174 - compile libunbound with libnss on Suse, passes regression tests. 6175 61763 July 2012: Wouter 6177 - FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes. 6178 61792 July 2012: Wouter 6180 - updated iana ports list. 6181 618229 June 2012: Wouter 6183 - patch for unbound_munin_ script to handle arbitrary thread count by 6184 Sven Ulland. 6185 618628 June 2012: Wouter 6187 - detect if openssl has FIPS_mode. 6188 - code review: return value of cache_store can be ignored for better 6189 performance in out of memory conditions. 6190 - fix edns-buffer-size and msg-buffer-size manpage documentation. 6191 - updated iana ports list. 6192 619325 June 2012: Wouter 6194 - disable RSAMD5 if in FIPS mode (for openssl and for libnss). 6195 619622 June 2012: Wouter 6197 - implement DS records, NSEC3 and ECDSA for compile with libnss. 6198 619921 June 2012: Wouter 6200 - fix error handling of alloc failure during rrsig verification. 6201 - nss check for verification failure. 6202 - nss crypto works for RSA and DSA. 6203 620420 June 2012: Wouter 6205 - work on --with-nss build option (for now, --with-libunbound-only). 6206 620719 June 2012: Wouter 6208 - --with-libunbound-only build option, only builds the library and 6209 not the daemon and other tools. 6210 621118 June 2012: Wouter 6212 - code review. 6213 621415 June 2012: Wouter 6215 - implement log-time-ascii on windows. 6216 - The key-cache bad key ttl is now 60 seconds. 6217 - updated iana ports list. 6218 - code review. 6219 622011 June 2012: Wouter 6221 - bug #452: fix crash on assert in mesh_state_attachment. 6222 622330 May 2012: Wouter 6224 - silence warning from swig-generated code (md set but not used in 6225 swig initmodule, due to ifdefs in swig-generated code). 6226 622727 May 2012: Wouter 6228 - Fix debian-bugs-658021: Please enable hardened build flags. 6229 623025 May 2012: Wouter 6231 - updated iana ports list. 6232 623324 May 2012: Wouter 6234 - tag for 1.4.17 release. 6235 - trunk is 1.4.18 in development. 6236 623718 May 2012: Wouter 6238 - Review comments, removed duplicate memset to zero in delegpt. 6239 624016 May 2012: Wouter 6241 - Updated doc/FEATURES with RFCs that are implemented but not listed. 6242 - Protect if statements in val_anchor for compile without locks. 6243 - tag for 1.4.17rc1. 6244 624515 May 2012: Wouter 6246 - fix configure ECDSA support in ldns detection for windows compile. 6247 - fix possible uninitialised variable in windows pipe implementation. 6248 62499 May 2012: Wouter 6250 - Fix alignment problem in util/random on sparc64/freebsd. 6251 62528 May 2012: Wouter 6253 - Fix for accept spinning reported by OpenBSD. 6254 - iana portlist updated. 6255 62562 May 2012: Wouter 6257 - Fix validation of nodata for DS query in NSEC zones, reported by 6258 Ondrej Mikle. 6259 626013 April 2012: Wouter 6261 - ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older 6262 openssl. 6263 626410 April 2012: Wouter 6265 - Applied patch from Daisuke HIGASHI for rrset-roundrobin and 6266 minimal-responses features. 6267 - iana portlist updated. 6268 62695 April 2012: Wouter 6270 - fix bug #443: --with-chroot-dir not honoured by configure. 6271 - fix bug #444: setusercontext was called too late (thanks Bjorn 6272 Ketelaars). 6273 627427 March 2012: Wouter 6275 - fix bug #442: Fix that Makefile depends on pythonmod headers 6276 even using --without-pythonmodule. 6277 627822 March 2012: Wouter 6279 - contrib/validation-reporter follows rotated log file (patch from 6280 Augie Schwer). 6281 628221 March 2012: Wouter 6283 - new approach to NS fetches for DS lookup that works with 6284 cornercases, and is more robust and considers forwarders. 6285 628619 March 2012: Wouter 6287 - iana portlist updated. 6288 - fix to locate nameservers for DS lookup with NS fetches. 6289 629016 March 2012: Wouter 6291 - Patch for access to full DNS packet data in unbound python module 6292 from Ondrej Mikle. 6293 62949 March 2012: Wouter 6295 - Applied line-buffer patch from Augie Schwer to validation.reporter.sh. 6296 62972 March 2012: Wouter 6298 - flush_infra cleans timeouted servers from the cache too. 6299 - removed warning from --enable-ecdsa. 6300 63011 March 2012: Wouter 6302 - forward-first option. Tries without forward if a query fails. 6303 Also stub-first option that is similar. 6304 630528 February 2012: Wouter 6306 - Fix from code review, if EINPROGRESS not defined chain if statement 6307 differently. 6308 630927 February 2012: Wouter 6310 - Fix bug#434: on windows check registry for config file location 6311 for unbound-control.exe, and unbound-checkconf.exe. 6312 631323 February 2012: Wouter 6314 - Fix to squelch 'network unreachable' errors from tcp connect in 6315 logs, high verbosity will show them. 6316 631716 February 2012: Wouter 6318 - iter_hints is now thread-owned in module env, and thus threadsafe. 6319 - Fix prefetch and sticky NS, now the prefetch works. It picks 6320 nameservers that 'would be valid in the future', and if this makes 6321 the NS timeout, it updates that NS by asking delegation from the 6322 parent again. If child NS has longer TTL, that TTL does not get 6323 refreshed from the lookup to the child nameserver. 6324 632515 February 2012: Wouter 6326 - Fix forward-zone memory, uses malloc and frees original root dp. 6327 - iter hints (stubs) uses malloc inside for more dynamicity. 6328 - unbound-control forward_add, forward_remove, stub_add, stub_remove 6329 can modify stubs and forwards for running unbound (on mobile computer) 6330 they can also add and remove domain-insecure for the zone. 6331 633214 February 2012: Wouter 6333 - Fix sticky NS (ghost domain problem) if prefetch is yes. 6334 - iter forwards uses malloc inside for more dynamicity. 6335 633613 February 2012: Wouter 6337 - RT#2955. Fix for cygwin compilation. 6338 - iana portlist updated. 6339 634010 February 2012: Wouter 6341 - Slightly smaller critical region in one case in infra cache. 6342 - Fix timeouts to keep track of query type, A, AAAA and other, if 6343 another has caused timeout blacklist, different type can still probe. 6344 - unit test fix for nomem_cnametopos.rpl race condition. 6345 63469 February 2012: Wouter 6347 - Fix AHX_BROKEN_MEMCMP for autoheader mess up of #undef in config.h. 6348 63498 February 2012: Wouter 6350 - implement draft-ietf-dnsext-ecdsa-04; which is in IETF LC; This 6351 implementation is experimental at this time and not recommended 6352 for use on the public internet (the protocol numbers have not 6353 been assigned). Needs recent ldns with --enable-ecdsa. 6354 - fix memory leak in errorcase for DSA signatures. 6355 - iana portlist updated. 6356 - workaround for openssl 0.9.8 ecdsa sha2 and evp problem. 6357 63583 February 2012: Wouter 6359 - fix for windows, rename() is not posix compliant on windows. 6360 63612 February 2012: Wouter 6362 - 1.4.16 release tag. 6363 - svn trunk is 1.4.17 in development. 6364 - iana portlist updated. 6365 63661 February 2012: Wouter 6367 - Fix validation failures (like: validation failure xx: no NSEC3 6368 closest encloser from yy for DS zz. while building chain of trust, 6369 because of a bug in the TTL-fix in 1.4.15, it picked the wrong rdata 6370 for an NSEC3. Now it does not change rdata, and fixes TTL. 6371 637230 January 2012: Wouter 6373 - Fix version-number in libtool to be version-info so it produces 6374 libunbound.so.2 like it should. 6375 637626 January 2012: Wouter 6377 - Tag 1.4.15 (same as 1.4.15rc1), for 1.4.15 release. 6378 - trunk 1.4.16; includes changes memset testcode, #424 openindiana, 6379 and keyfile write fixup. 6380 - applied patch to support outgoing-interface with ub_ctx_set_option. 6381 638223 January 2012: Wouter 6383 - Fix memset in test code. 6384 638520 January 2012: Wouter 6386 - Fix bug #424: compile on OpenIndiana OS with gcc 4.6.2. 6387 638819 January 2012: Wouter 6389 - Fix to write key files completely to a temporary file, and if that 6390 succeeds, replace the real key file. So failures leave a useful file. 6391 639218 January 2012: Wouter 6393 - tag 1.4.15rc1 created 6394 - updated libunbound/ubsyms.def and remade tag 1.4.15rc1. 6395 639617 January 2012: Wouter 6397 - Fix bug where canonical_compare of RRSIG did not downcase the 6398 signer-name. This is mostly harmless because RRSIGs do not have 6399 to be sorted in canonical order, usually. 6400 640112 January 2012: Wouter 6402 - bug#428: add ub_version() call to libunbound. API version increase, 6403 with (binary) backwards compatibility for the previous version. 6404 640510 January 2012: Wouter 6406 - Fix bug #425: unbound reports wrong TTL in reply, it reports a TTL 6407 that would be permissible by the RFCs but it is not the TTL in the 6408 cache. 6409 - iana portlist updated. 6410 - uninitialised variable in reprobe for rtt blocked domains fixed. 6411 - lintfix and new flex output. 6412 64132 January 2012: Wouter 6414 - Fix to randomize hash function, based on 28c3 congress, reported 6415 by Peter van Dijk. 6416 641724 December 2011: Wouter 6418 - Fix for memory leak (about 20 bytes when a tcp or udp send operation 6419 towards authority servers failed, takes about 50.000 such failures to 6420 leak one Mb, such failures are also usually logged), reported by 6421 Robert Fleischmann. 6422 - iana portlist updated. 6423 642419 December 2011: Wouter 6425 - Fix for VU#209659 CVE-2011-4528: Unbound denial of service 6426 vulnerabilities from nonstandard redirection and denial of existence 6427 http://www.unbound.net/downloads/CVE-2011-4528.txt 6428 - robust checks for next-closer NSEC3s. 6429 - tag 1.4.14 created. 6430 - trunk has 1.4.15 in development. 6431 643215 December 2011: Wouter 6433 - remove uninit warning from cachedump code. 6434 - Fix parse error on negative SOA RRSIGs if badly ordered in the packet. 6435 643613 December 2011: Wouter 6437 - iana portlist updated. 6438 - svn tag 1.4.14rc1 6439 - fix infra cache comparison. 6440 - Fix to constrain signer_name to be a parent of the lookupname. 6441 64425 December 2011: Wouter 6443 - Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. 6444 - Fix warnings with gcc 4.6 in compat/inet_ntop.c. 6445 - Fix warning unused in compat/strptime.c. 6446 - Fix malloc detection and double definition. 6447 64482 December 2011: Wouter 6449 - configure generated with autoconf 2.68. 6450 645130 November 2011: Wouter 6452 - Fix for tcp-upstream and ssl-upstream for if a laptop sleeps, causes 6453 SERVFAILs. Also fixed for UDP (but less likely). 6454 645528 November 2011: Wouter 6456 - Fix quartile time estimate, it was too low, (thanks Jan Komissar). 6457 - iana ports updated. 6458 645911 November 2011: Wouter 6460 - Makefile compat with SunOS make, BSD make and GNU make. 6461 - iana ports updated. 6462 646310 November 2011: Wouter 6464 - Makefile changed for BSD make compatibility. 6465 64669 November 2011: Wouter 6467 - added unit test for SSL service and SSL-upstream. 6468 64698 November 2011: Wouter 6470 - can configure ssl service to one port number, and not on others. 6471 - fixup windows compile with ssl support. 6472 - Fix double free in unbound-host, reported by Steve Grubb. 6473 - iana portlist updated. 6474 64751 November 2011: Wouter 6476 - dns over ssl support as a client, ssl-upstream yes turns it on. 6477 It performs an SSL transaction for every DNS query (250 msec). 6478 - documentation for new options: ssl-upstream, ssl-service-key and 6479 ssl-service.pem. 6480 - iana portlist updated. 6481 - fix -flto detection on Lion for llvm-gcc. 6482 648331 October 2011: Wouter 6484 - dns over ssl support, ssl-service-pem and ssl-service-key files 6485 can be given and then TCP queries are serviced wrapped in SSL. 6486 648727 October 2011: Wouter 6488 - lame-ttl and lame-size options no longer exist, it is integrated 6489 with the host info. They are ignored (with verbose warning) if 6490 encountered to keep the config file backwards compatible. 6491 - fix iana-update for changing gzip compression of results. 6492 - fix export-all-symbols on OSX. 6493 649426 October 2011: Wouter 6495 - iana portlist updated. 6496 - Infra cache stores information about ping and lameness per IP, zone. 6497 This fixes bug #416. 6498 - fix iana_update target for gzipped file on iana site. 6499 650024 October 2011: Wouter 6501 - Fix resolve of partners.extranet.microsoft.com with a fix for the 6502 server selection for choosing out of a (particular) list of bad 6503 choices. (bug#415) 6504 - Fix make_new_space function so that the incoming query is not 6505 overwritten if a jostled out query causes a waiting query to be 6506 resumed that then fails and sends an error message. (Thanks to 6507 Matthew Lee). 6508 650921 October 2011: Wouter 6510 - fix --enable-allsymbols, fptr wlist is disabled on windows with this 6511 option enabled because of memory layout exe vs dll. 6512 651319 October 2011: Wouter 6514 - fix unbound-anchor for broken strptime on OSX lion, detected 6515 in configure. 6516 - Detect if GOST really works, openssl1.0 on OSX fails. 6517 - Implement ipv6%interface notation for scope_id usage. 6518 651917 October 2011: Wouter 6520 - better documentation for inform_super (Thanks Yang Zhe). 6521 652214 October 2011: Wouter 6523 - Fix for out-of-memory condition in libunbound (thanks 6524 Robert Fleischman). 6525 652613 October 2011: Wouter 6527 - Fix --enable-allsymbols, it depended on link specifics of the 6528 target platform, or fptr_wlist assertion failures could occur. 6529 653012 October 2011: Wouter 6531 - updated contrib/unbound_munin_ to family=auto so that it works with 6532 munin-node-configure automatically (if installed as 6533 /usr/local/share/munin/plugins/unbound_munin_ ). 6534 653527 September 2011: Wouter 6536 - unbound.exe -w windows option for start and stop service. 6537 653823 September 2011: Wouter 6539 - TCP-upstream calculates tcp-ping so server selection works if there 6540 are alternatives. 6541 654220 September 2011: Wouter 6543 - Fix classification of NS set in answer section, where there is a 6544 parent-child server, and the answer has the AA flag for dir.slb.com. 6545 Thanks to Amanda Constant from Secure64. 6546 654716 September 2011: Wouter 6548 - fix bug #408: accept patch from Steve Snyder that comments out 6549 unused functions in lookup3.c. 6550 - iana portlist updated. 6551 - fix EDNS1480 change memleak and TCP fallback. 6552 - fix various compiler warnings (reported by Paul Wouters). 6553 - max sent count. EDNS1480 only for rtt < 5000. No promiscuous 6554 fetch if sentcount > 3, stop query if sentcount > 16. Count is 6555 reset when referral or CNAME happens. This makes unbound better 6556 at managing large NS sets, they are explored when there is continued 6557 interest (in the form of queries). 6558 655915 September 2011: Wouter 6560 - release 1.4.13. 6561 - trunk contains 1.4.14 in development. 6562 - Unbound probes at EDNS1480 if there an EDNS0 timeout. 6563 656412 September 2011: Wouter 6565 - Reverted dns EDNS backoff fix, it did not help and needs 6566 fragmentation fixes instead. 6567 - tag 1.4.13rc2 6568 65697 September 2011: Wouter 6570 - Fix operation in ipv6 only (do-ip4: no) mode. 6571 65726 September 2011: Wouter 6573 - fedora specfile updated. 6574 65755 September 2011: Wouter 6576 - tag 1.4.13rc1 6577 65782 September 2011: Wouter 6579 - iana portlist updated. 6580 658126 August 2011: Wouter 6582 - Fix num-threads 0 does not segfault, reported by Simon Deziel. 6583 - Fix validation failures due to EDNS backoff retries, the retry 6584 for fetch of data has want_dnssec because the iter_indicate_dnssec 6585 function returns true when validation failure retry happens, and 6586 then the serviced query code does not fallback to noEDNS, even if 6587 the cache says it has this. This helps for DLV deployment when 6588 the DNSSEC status is not known for sure before the lookup concludes. 6589 659024 August 2011: Wouter 6591 - Applied patch from Karel Slany that fixes a memory leak in the 6592 unbound python module, in string conversions. 6593 659422 August 2011: Wouter 6595 - Fix validation of qtype ANY responses with CNAMEs (thanks Cathy 6596 Zhang and Luo Ce). Unbound responds with the RR types that are 6597 available at the name for qtype ANY and validates those RR types. 6598 It does not test for completeness (i.e. with NSEC or NSEC3 query), 6599 and it does not follow the CNAME or DNAME to another name (with 6600 even more data for the already large response). 6601 - Fix that internally, CNAMEs with NXDOMAIN have that as rcode. 6602 - Documented the options that work with control set_option command. 6603 - tcp-upstream yes/no option (works with set_option) for tunnels. 6604 660518 August 2011: Wouter 6606 - fix autoconf call in makedist crosscompile to RC or snapshot. 6607 660817 August 2011: Wouter 6609 - Fix validation of . DS query. 6610 - new xml format at IANA, new awk for iana_update. 6611 - iana portlist updated. 6612 661310 August 2011: Wouter 6614 - Fix python site-packages path to /usr/lib64. 6615 - updated patch from Tom. 6616 - fix memory and fd leak after out-of-memory condition. 6617 66189 August 2011: Wouter 6619 - patch from Tom Hendrikx fixes load of python modules. 6620 66218 August 2011: Wouter 6622 - make clean had ldns-src reference, removed. 6623 66241 August 2011: Wouter 6625 - Fix autoconf 2.68 warnings 6626 662714 July 2011: Wouter 6628 - Unbound implements RFC6303 (since version 1.4.7). 6629 - tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the 6630 meantime, those are for 1.4.13). 6631 - iana portlist updated. 6632 663313 July 2011: Wouter 6634 - Quick fix for contrib/unbound.spec example, no ldns-builtin any more. 6635 663611 July 2011: Wouter 6637 - Fix wildcard expansion no-data reply under an optout NSEC3 zone is 6638 validated as insecure, reported by Jia Li (lijia@cnnic.cn). 6639 66404 July 2011: Wouter 6641 - 1.4.12rc1 tag created. 6642 66431 July 2011: Wouter 6644 - version number in example config file. 6645 - fix that --enable-static-exe does not complain about it unknown. 6646 664730 June 2011: Wouter 6648 - tag relase 1.4.11, trunk is 1.4.12 development. 6649 - iana portlist updated. 6650 - fix bug#395: id bits of other query may leak out under conditions 6651 - fix replyaddr count wrong after jostled queries, which leads to 6652 eventual starvation where the daemon has no replyaddrs left to use. 6653 - fix comment about rndc port, that referred to the old port number. 6654 - fix that the listening socket is not closed when too many remote 6655 control connections are made at the same time. 6656 - removed ldns-src tarball inside the unbound tarball. 6657 665823 June 2011: Wouter 6659 - Changed -flto check to support clang compiler. 6660 - tag 1.4.11rc3 created. 6661 666217 June 2011: Wouter 6663 - tag 1.4.11rc1 created. 6664 - remove warning about signed/unsigned from flex (other flex version). 6665 - updated aclocal.m4 and libtool to match. 6666 - tag 1.4.11rc2 created. 6667 666816 June 2011: Wouter 6669 - log-queries: yesno option, default is no, prints querylog. 6670 - version is 1.4.11. 6671 667214 June 2011: Wouter 6673 - Use -flto compiler flag for link time optimization, if supported. 6674 - iana portlist updated. 6675 667612 June 2011: Wouter 6677 - IPv6 service address for d.root-servers.net (2001:500:2D::D). 6678 667910 June 2011: Wouter 6680 - unbound-control has version number in the header, 6681 UBCT[version]_space_ is the header sent by the client now. 6682 - Unbound control port number is registered with IANA: 6683 ub-dns-control 8953/tcp unbound dns nameserver control 6684 This is the new default for the control-port config setting. 6685 - statistics-interval prints the number of jostled queries to log. 6686 668730 May 2011: Wouter 6688 - Fix Makefile for U in environment, since wrong U is more common than 6689 deansification necessity. 6690 - iana portlist updated. 6691 - updated ldns tarball to 1.6.10rc2 snapshot of today. 6692 669325 May 2011: Wouter 6694 - Fix assertion failure when unbound generates an empty error reply 6695 in response to a query, CVE-2011-1922 VU#531342. 6696 - This fix is in tag 1.4.10. 6697 - defense in depth against the above bug, an error is printed to log 6698 instead of an assertion failure. 6699 670010 May 2011: Wouter 6701 - bug#386: --enable-allsymbols option links all binaries to libunbound 6702 and reduces install size significantly. 6703 - feature, ignore-cd-flag: yesno to provide dnssec to legacy servers. 6704 - iana portlist updated. 6705 - Fix TTL of SOA so negative TTL is separately cached from normal TTL. 6706 670714 April 2011: Wouter 6708 - configure created with newer autoconf 2.66. 6709 671012 April 2011: Wouter 6711 - bug#378: Fix that configure checks for ldns_get_random presence. 6712 67138 April 2011: Wouter 6714 - iana portlist updated. 6715 - queries with CD flag set cause DNSSEC validation, but the answer is 6716 not withheld if it is bogus. Thus, unbound will retry if it is bad 6717 and curb the TTL if it is bad, thus protecting the cache for use by 6718 downstream validators. 6719 - val-override-date: -1 ignores dates entirely, for NTP usage. 6720 672129 March 2011: Wouter 6722 - harden-below-nxdomain: changed so that it activates when the 6723 cached nxdomain is dnssec secure. This avoids backwards 6724 incompatibility because those old servers do not have dnssec. 6725 672624 March 2011: Wouter 6727 - iana portlist updated. 6728 - release 1.4.9. 6729 - trunk is 1.5.0 6730 673117 March 2011: Wouter 6732 - bug#370: new unbound.spec for CentOS 5.x from Harold Jones. 6733 Applied but did not do the --disable-gost. 6734 673510 March 2011: Wouter 6736 - tag 1.4.9 release candidate 1 created. 6737 67383 March 2011: Wouter 6739 - updated ldns to today. 6740 67411 March 2011: Wouter 6742 - Fix no ADflag for NXDOMAIN in NSEC3 optout. And wildcard in optout. 6743 - give config parse error for multiple names on a stub or forward zone. 6744 - updated ldns tarball to 1.6.9(todays snapshot). 6745 674624 February 2011: Wouter 6747 - bug #361: Fix, time.elapsed variable not reset with stats_noreset. 6748 674923 February 2011: Wouter 6750 - iana portlist updated. 6751 - common.sh to version 3. 6752 675318 February 2011: Wouter 6754 - common.sh in testdata updated to version 2. 6755 675615 February 2011: Wouter 6757 - Added explicit note on unbound-anchor usage: 6758 Please note usage of unbound-anchor root anchor is at your own risk 6759 and under the terms of our LICENSE (see that file in the source). 6760 676111 February 2011: Wouter 6762 - iana portlist updated. 6763 - tpkg updated with common.sh for common functionality. 6764 67657 February 2011: Wouter 6766 - Added regression test for addition of a .net DS to the root, and 6767 cache effects with different TTL for glue and DNSKEY. 6768 - iana portlist updated. 6769 677028 January 2011: Wouter 6771 - Fix remove private address does not throw away entire response. 6772 677324 January 2011: Wouter 6774 - release 1.4.8 6775 677619 January 2011: Wouter 6777 - fix bug#349: no -L/usr for ldns. 6778 677918 January 2011: Wouter 6780 - ldns 1.6.8 tarball included. 6781 - release 1.4.8rc1. 6782 678317 January 2011: Wouter 6784 - add get and set option for harden-below-nxdomain feature. 6785 - iana portlist updated. 6786 678714 January 2011: Wouter 6788 - Fix so a changed NS RRset does not get moved name stuck on old 6789 server, for type NS the TTL is not increased. 6790 679113 January 2011: Wouter 6792 - Fix prefetch so it does not get stuck on old server for moved names. 6793 679412 January 2011: Wouter 6795 - iana portlist updated. 6796 679711 January 2011: Wouter 6798 - Fix insecure CNAME sequence marked as secure, reported by Bert 6799 Hubert. 6800 680110 January 2011: Wouter 6802 - faster lruhash get_mem routine. 6803 68044 January 2011: Wouter 6805 - bug#346: remove ITAR scripts from contrib, the service is discontinued, use the root. 6806 - iana portlist updated. 6807 680823 December 2010: Wouter 6809 - Fix in infra cache that could cause rto larger than TOP_TIMEOUT kept. 6810 681121 December 2010: Wouter 6812 - algorithm compromise protection using the algorithms signalled in 6813 the DS record. Also, trust anchors, DLV, and RFC5011 receive this, 6814 and thus, if you have multiple algorithms in your trust-anchor-file 6815 then it will now behave different than before. Also, 5011 rollover 6816 for algorithms needs to be double-signature until the old algorithm 6817 is revoked. 6818 It is not an option, because I see no use to turn the security off. 6819 - iana portlist updated. 6820 682117 December 2010: Wouter 6822 - squelch 'tcp connect: bla' in logfile, (set verbosity 2 to see them). 6823 - fix validation in this case: CNAME to nodata for co-hosted opt-in 6824 NSEC3 insecure delegation, was bogus, fixed to be insecure. 6825 682616 December 2010: Wouter 6827 - Fix our 'BDS' license (typo reported by Xavier Belanger). 6828 682910 December 2010: Wouter 6830 - iana portlist updated. 6831 - review changes for unbound-anchor. 6832 68332 December 2010: Wouter 6834 - feature typetransparent localzone, does not block other RR types. 6835 68361 December 2010: Wouter 6837 - Fix bug#338: print address when socket creation fails. 6838 683930 November 2010: Wouter 6840 - Fix storage of EDNS failures in the infra cache. 6841 - iana portlist updated. 6842 684318 November 2010: Wouter 6844 - harden-below-nxdomain option, default off (because very old 6845 software may be incompatible). We could enable it by default in 6846 the future. 6847 684817 November 2010: Wouter 6849 - implement draft-vixie-dnsext-resimprove-00, we stop on NXDOMAIN. 6850 - make test output nicer. 6851 685215 November 2010: Wouter 6853 - silence 'tcp connect: broken pipe' and 'net down' at low verbosity. 6854 - iana portlist updated. 6855 - so-sndbuf option for very busy servers, a bit like so-rcvbuf. 6856 68579 November 2010: Wouter 6858 - unbound-anchor compiles with openssl 0.9.7. 6859 68608 November 2010: Wouter 6861 - release tag 1.4.7. 6862 - trunk is version 1.4.8. 6863 - Be lenient and accept imgw.pl malformed packet (like BIND). 6864 68655 November 2010: Wouter 6866 - do not synthesize a CNAME message from cache for qtype DS. 6867 68684 November 2010: Wouter 6869 - Use central entropy to seed threads. 6870 68713 November 2010: Wouter 6872 - Change the rtt used to probe EDNS-timeout hosts to 1000 msec. 6873 68742 November 2010: Wouter 6875 - tag 1.4.7rc1. 6876 - code review. 6877 68781 November 2010: Wouter 6879 - GOST code enabled by default (RFC 5933). 6880 688127 October 2010: Wouter 6882 - Fix uninit value in dump_infra print. 6883 - Fix validation failure for parent and child on same server with an 6884 insecure childzone and a CNAME from parent to child. 6885 - Configure detects libev-4.00. 6886 688726 October 2010: Wouter 6888 - dump_infra and flush_infra commands for unbound-control. 6889 - no timeout backoff if meanwhile a query succeeded. 6890 - Change of timeout code. No more lost and backoff in blockage. 6891 At 12sec timeout (and at least 2x lost before) one probe per IP 6892 is allowed only. At 120sec, the IP is blocked. After 15min, a 6893 120sec entry has a single retry packet. 6894 689525 October 2010: Wouter 6896 - Configure errors if ldns is not found. 6897 689822 October 2010: Wouter 6899 - Windows 7 fix for the installer. 6900 690121 October 2010: Wouter 6902 - Fix bug where fallback_tcp causes wrong roundtrip and edns 6903 observation to be noted in cache. Fix bug where EDNSprobe halted 6904 exponential backoff if EDNS status unknown. 6905 - new unresponsive host method, exponentially increasing block backoff. 6906 - iana portlist updated. 6907 690820 October 2010: Wouter 6909 - interface automatic works for some people with ip6 disabled. 6910 Therefore the error check is removed, so they can use the option. 6911 691219 October 2010: Wouter 6913 - Fix for request list growth, if a server has long timeout but the 6914 lost counter is low, then its effective rtt is the one without 6915 exponential backoff applied. Because the backoff is not working. 6916 The lost counter can then increase and the server is blacklisted, 6917 or the lost counter does not increase and the server is working 6918 for some queries. 6919 692018 October 2010: Wouter 6921 - iana portlist updated. 6922 692313 October 2010: Wouter 6924 - Fix TCP so it uses a random outgoing-interface. 6925 - unbound-anchor handles ADDPEND keystate. 6926 692711 October 2010: Wouter 6928 - Fix bug when DLV below a trust-anchor that uses NSEC3 optout where 6929 the zone has a secure delegation hosted on the same server did not 6930 verify as secure (it was insecure by mistake). 6931 - iana portlist updated. 6932 - ldns tarball updated (for reading cachedumps with bad RR data). 6933 69341 October 2010: Wouter 6935 - test for unbound-anchor. fix for reading certs. 6936 - Fix alloc_reg_release for longer uptime in out of memory conditions. 6937 693828 September 2010: Wouter 6939 - unbound-anchor working, it creates or updates a root.key file. 6940 Use it before you start the validator (e.g. at system boot time). 6941 694227 September 2010: Wouter 6943 - iana portlist updated. 6944 694524 September 2010: Wouter 6946 - bug#329: in example.conf show correct ipv4 link-local 169.254/16. 6947 694823 September 2010: Wouter 6949 - unbound-anchor app, unbound requires libexpat (xml parser library). 6950 695122 September 2010: Wouter 6952 - compliance with draft-ietf-dnsop-default-local-zones-14, removed 6953 reverse ipv6 orchid prefix from builtin list. 6954 - iana portlist updated. 6955 695617 September 2010: Wouter 6957 - DLV has downgrade protection again, because the RFC says so. 6958 - iana portlist updated. 6959 696016 September 2010: Wouter 6961 - Algorithm rollover operational reality intrudes, for trust-anchor, 6962 5011-store, and DLV-anchor if one key matches it's good enough. 6963 - iana portlist updated. 6964 - Fix reported validation error in out of memory condition. 6965 696615 September 2010: Wouter 6967 - Abide RFC5155 section 9.2: no AD flag for replies with NSEC3 optout. 6968 696914 September 2010: Wouter 6970 - increased mesh-max-activation from 1000 to 3000 for crazy domains 6971 like _tcp.slb.com with 262 servers. 6972 - iana portlist updated. 6973 697413 September 2010: Wouter 6975 - bug#327: Fix for cannot access stub zones until the root is primed. 6976 69779 September 2010: Wouter 6978 - unresponsive servers are not completely blacklisted (because of 6979 firewalls), but also not probed all the time (because of the request 6980 list size it generates). The probe rate is 1%. 6981 - iana portlist updated. 6982 698320 August 2010: Wouter 6984 - openbsd-lint fixes: acl_list_get_mem used if debug-alloc enabled. 6985 iterator get_mem includes priv_get_mem. delegpt nodup removed. 6986 listen_pushback, query_info_allocqname, write_socket, send_packet, 6987 comm_point_set_cb_arg and listen_resume removed. 6988 698919 August 2010: Wouter 6990 - Fix bug#321: resolution of rs.ripe.net artifacts with 0x20. 6991 Delegpt structures checked for duplicates always. 6992 No more nameserver lookups generated when depth is full anyway. 6993 - example.conf notes how to do DNSSEC validation and track the root. 6994 - iana portlist updated. 6995 699618 August 2010: Wouter 6997 - Fix bug#322: configure does not respect CFLAGS on Solaris. 6998 Pass CFLAGS="-xO4 -xtarget=generic" on the configure command line 6999 if use sun-cc, but some systems need different flags. 7000 700116 August 2010: Wouter 7002 - Fix acx_nlnetlabs.m4 configure output for autoconf-2.66 AS_TR_CPP 7003 changes, uses m4_bpatsubst now. 7004 - make test (or make check) should be more portable and run the unit 7005 test and testbound scripts. (make longtest has special requirements). 7006 700713 August 2010: Wouter 7008 - More pleasant remote control command parsing. 7009 - documentation added for return values reported by doxygen 1.7.1. 7010 - iana portlist updated. 7011 70129 August 2010: Wouter 7013 - Fix name of rrset printed that failed validation. 7014 70155 August 2010: Wouter 7016 - Return NXDOMAIN after chain of CNAMEs ends at name-not-found. 7017 70184 August 2010: Wouter 7019 - Fix validation in case a trust anchor enters into a zone with 7020 unsupported algorithms. 7021 70223 August 2010: Wouter 7023 - updated ldns tarball with bugfixes. 7024 - release tag 1.4.6. 7025 - trunk becomes 1.4.7 develop. 7026 - iana portlist updated. 7027 702822 July 2010: Wouter 7029 - more error details on failed remote control connection. 7030 703115 July 2010: Wouter 7032 - rlimit adjustments for select and ulimit can happen at the same time. 7033 703414 July 2010: Wouter 7035 - Donation text added to README. 7036 - Fix integer underflow in prefetch ttl creation from cache. This 7037 fixes a potential negative prefetch ttl. 7038 703912 July 2010: Wouter 7040 - Changed the defaults for num-queries-per-thread/outgoing-range. 7041 For builtin-select: 512/960, for libevent 1024/4096 and for 7042 windows 24/48 (because of win api). This makes the ratio this way 7043 to improve resilience under heavy load. For high performance, use 7044 libevent and possibly higher numbers. 7045 704610 July 2010: Wouter 7047 - GOST enabled if SSL is recent and ldns has GOST enabled too. 7048 - ldns tarball updated. 7049 70509 July 2010: Wouter 7051 - iana portlist updated. 7052 - Fix validation of qtype DNSKEY when a key-cache entry exists but 7053 no rr-cache entry is used (it expired or prefetch), it then goes 7054 back up to the DS or trust-anchor to validate the DNSKEY. 7055 70567 July 2010: Wouter 7057 - Neat function prototypes, unshadowed local declarations. 7058 70596 July 2010: Wouter 7060 - failure to chown the pidfile is not fatal any more. 7061 - testbound uses UTC timezone. 7062 - ldns tarball updated (ports and works on Minix 3.1.7). On Minix, add 7063 /usr/gnu/bin to PATH, use ./configure AR=/usr/gnu/bin/gar and gmake. 7064 70655 July 2010: Wouter 7066 - log if a server is skipped because it is on the donotquery list, 7067 at verbosity 4, to enable diagnosis why no queries to 127.0.0.1. 7068 - added feature to print configure date, target and options with -h. 7069 - added feature to print event backend system details with -h. 7070 - wdiff is not actually required by make test, updated requirements. 7071 70721 July 2010: Wouter 7073 - Fix RFC4035 compliance with 2.2 statement that the DNSKEY at apex 7074 must be signed with all algorithms from the DS rrset at the parent. 7075 This is now checked and becomes bogus if not. 7076 707728 June 2010: Wouter 7078 - Fix jostle list bug found by Vince (luoce@cnnic), it caused the qps 7079 in overload situations to be about 5 qps for the class of shortly 7080 serviced queries. 7081 The capacity of the resolver is then about (numqueriesperthread / 2) 7082 / (average time for such long queries) qps for long queries. 7083 And about (numqueriesperthread / 2)/(jostletimeout in whole seconds) 7084 qps for short queries, per thread. 7085 - Fix the max number of reply-address count to be applied for duplicate 7086 queries, and not for new query list entries. This raises the memory 7087 usage to a max of (16+1)*numqueriesperthread reply addresses. 7088 708925 June 2010: Wouter 7090 - Fix handling of corner case reply from lame server, follows rfc2308. 7091 It could lead to a nodata reply getting into the cache if the search 7092 for a non-lame server turned up other misconfigured servers. 7093 - unbound.h has extern "C" statement for easier include in c++. 7094 709523 June 2010: Wouter 7096 - iana portlist updated. 7097 - makedist upgraded cross compile openssl option, like this: 7098 ./makedist.sh -s -wssl openssl-1.0.0a.tar.gz -w --enable-gost 7099 710022 June 2010: Wouter 7101 - Unbound reports libev or libevent correctly in logs in verbose mode. 7102 - Fix to unload gost dynamic library module for leak testing. 7103 710418 June 2010: Wouter 7105 - iana portlist updated. 7106 710717 June 2010: Wouter 7108 - Add AAAA to root hints for I.ROOT-SERVERS.NET. 7109 711016 June 2010: Wouter 7111 - Fix assertion failure reported by Kai Storbeck from XS4ALL, the 7112 assertion was wrong. 7113 - updated ldns tarball. 7114 711515 June 2010: Wouter 7116 - tag 1.4.5 created. 7117 - trunk contains 1.4.6 in development. 7118 - Fix TCPreply on systems with no writev, if just 1 byte could be sent. 7119 - Fix to use one pointer less for iterator query state store_parent_NS. 7120 - makedist crosscompile to windows uses builtin ldns not host ldns. 7121 - Max referral count from 30 to 130, because 128 one character domains 7122 is valid DNS. 7123 - added documentation for the histogram printout to syslog. 7124 712511 June 2010: Wouter 7126 - When retry to parent the retrycount is not wiped, so failed 7127 nameservers are not tried again. 7128 - iana portlist updated. 7129 713010 June 2010: Wouter 7131 - Fix bug where a long loop could be entered, now cycle detection 7132 has a loop-counter and maximum search amount. 7133 71344 June 2010: Wouter 7135 - iana portlist updated. 7136 - 1.4.5rc1 tag created. 7137 71383 June 2010: Wouter 7139 - ldns tarball updated, 1.6.5. 7140 - review comments, split dependency cycle tracking for parentside 7141 last resort lookups for A and AAAA so there are more lookup options. 7142 71432 June 2010: Wouter 7144 - Fix compile warning if compiled without threads. 7145 - updated ldns-tarball with current ldns svn (pre 1.6.5). 7146 - GOST disabled-by-default, the algorithm number is allocated but the 7147 RFC is still has to pass AUTH48 at the IETF. 7148 71491 June 2010: Wouter 7150 - Ignore Z flag in incoming messages too. 7151 - Fix storage of negative parent glue if that last resort fails. 7152 - libtoolize 2.2.6b, autoconf 2.65 applied to configure. 7153 - new splint flags for newer splint install. 7154 715531 May 2010: Wouter 7156 - Fix AD flag handling, it could in some cases mistakenly copy the AD 7157 flag from upstream servers. 7158 - alloc_special_obtain out of memory is not a fatal error any more, 7159 enabling unbound to continue longer in out of memory conditions. 7160 - parentside names are dispreferred but not said to be dnssec-lame. 7161 - parentside check for cached newname glue. 7162 - fix parentside and querytargets modulestate, for dump_requestlist. 7163 - unbound-control-setup makes keys -rw-r--- so not all users permitted. 7164 - fix parentside from cache to be marked dispreferred for bad names. 7165 716628 May 2010: Wouter 7167 - iana portlist updated. 7168 - parent-child disagreement approach altered. Older fixes are 7169 removed in place of a more exhaustive search for misconfigured data 7170 available via the parent of a delegation. 7171 This is designed to be throttled by cache entries, with TTL from the 7172 parent if possible. Additionally the loop-counter is used. 7173 It also tests for NS RRset differences between parent and child. 7174 The fetch of misconfigured data should be more reliable and thorough. 7175 It should work reliably even with no or only partial data in cache. 7176 Data received from the child (as always) is deemed more 7177 authoritative than information received from the delegation parent. 7178 The search for misconfigured data is not performed normally. 7179 718026 May 2010: Wouter 7181 - Contribution from Migiel de Vos (Surfnet): nagios patch for 7182 unbound-host, in contrib/ (in the source tarball). Makes 7183 unbound-host suitable for monitoring dnssec(-chain) status. 7184 718521 May 2010: Wouter 7186 - EDNS timeout code will not fire if EDNS status already known. 7187 - EDNS failure not stored if EDNS status known to work. 7188 718919 May 2010: Wouter 7190 - Fix resolution for domains like safesvc.com.cn. If the iterator 7191 can not recurse further and it finds the delegation in a state 7192 where it would otherwise have rejected it outhand if so received 7193 from a cache lookup, then it can try to ask higherup (with loop 7194 protection). 7195 - Fix comments in iter_utils:dp_is_useless. 7196 719718 May 2010: Wouter 7198 - Fix various compiler warnings from the clang llvm compiler. 7199 - iana portlist updated. 7200 72016 May 2010: Wouter 7202 - Fix bug#308: spelling error in variable name in parser and lexer. 7203 72044 May 2010: Wouter 7205 - Fix dnssec-missing detection that was turned off by server selection. 7206 - Conforms to draft-ietf-dnsop-default-local-zones-13. Added default 7207 reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa, 7208 113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa. 7209 721029 April 2010: Wouter 7211 - Fix for dnssec lameness detection to use the key cache. 7212 - infra cache entries that are expired are wiped clean. Previously 7213 it was possible to not expire host data (if accessed often). 7214 721528 April 2010: Wouter 7216 - ldns tarball updated and GOST support is detected and then enabled. 7217 - iana portlist updated. 7218 - Fix detection of gost support in ldns (reported by Chris Smith). 7219 722027 April 2010: Wouter 7221 - unbound-control get_option domain-insecure shows config file items. 7222 - fix retry sequence if prime hints are recursion-lame. 7223 - autotrust anchor file can be initialized with a ZSK key as well. 7224 - harden-referral-path does not result in failures due to max-depth. 7225 You can increase the max-depth by adding numbers (' 0') after the 7226 target-fetch-policy, this increases the depth to which is checked. 7227 722826 April 2010: Wouter 7229 - Compile fix using Sun Studio 12 compiler on Solaris 5.9, use 7230 CPPFLAGS during configure process. 7231 - if libev is installed on the base system (not libevent), detect 7232 it from the event.h header file and link with -lev. 7233 - configlexer.lex gets config.h, and configyyrename.h added by make, 7234 no more double include. 7235 - More strict scrubber (Thanks to George Barwood for the idea): 7236 NS set must be pertinent to the query (qname subdomain nsname). 7237 - Fix bug#307: In 0x20 backoff fix fallback so the number of 7238 outstanding queries does not become -1 and block the request. 7239 Fixed handling of recursion-lame in combination with 0x20 fallback. 7240 Fix so RRsets are compared canonicalized and sorted if the immediate 7241 comparison fails, this makes it work around round-robin sites. 7242 724323 April 2010: Wouter 7244 - Squelch log message: sendto failed permission denied for 7245 255.255.255.255, it is visible in VERB_DETAIL (verbosity 2). 7246 - Fix to fetch data as last resort more tenaciously. When cycle 7247 targets cause the server selection to believe there are more options 7248 when they really are not there, the server selection is reinitiated. 7249 - Fix fetch from blacklisted dnssec lame servers as last resort. The 7250 server's IP address is then given in validator errors as well. 7251 - Fix local-zone type redirect that did not use the query name for 7252 the answer rrset. 7253 725422 April 2010: Wouter 7255 - tag 1.4.4. 7256 - trunk contains 1.4.5 in development. 7257 - Fix validation failure for qtype ANY caused by a RRSIG parse failure. 7258 The validator error message was 'no signatures from ...'. 7259 726016 April 2010: Wouter 7261 - more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN. 7262 - tag 1.4.4rc1. 7263 726415 April 2010: Wouter 7265 - ECC-GOST algorithm number 12 that is assigned by IANA. New test 7266 example key and signatures for GOST. GOST requires openssl-1.0.0. 7267 GOST is still disabled by default. 7268 72699 April 2010: Wouter 7270 - Fix bug#305: pkt_dname_tolower could read beyond end of buffer or 7271 get into an endless loop, if 0x20 was enabled, and buffers are small 7272 or particular broken packets are received. 7273 - Fix chain of trust with CNAME at an intermediate step, for the DS 7274 processing proof. 7275 72768 April 2010: Wouter 7277 - Fix validation of queries with wildcard names (*.example). 7278 72796 April 2010: Wouter 7280 - Fix EDNS probe for .de DNSSEC testbed failure, where the infra 7281 cache timeout coincided with a server update, the current EDNS 7282 backoff is less sensitive, and does not cache the backoff unless 7283 the backoff actually works and the domain is not expecting DNSSEC. 7284 - GOST support with correct algorithm numbers. 7285 72861 April 2010: Wouter 7287 - iana portlist updated. 7288 728924 March 2010: Wouter 7290 - unbound control flushed items are not counted when flushed again. 7291 729223 March 2010: Wouter 7293 - iana portlist updated. 7294 729522 March 2010: Wouter 7296 - unbound-host disables use-syslog from config file so that the 7297 config file for the main server can be used more easily. 7298 - fix bug#301: unbound-checkconf could not parse interface 7299 '0.0.0.0@5353', even though unbound itself worked fine. 7300 730119 March 2010: Wouter 7302 - fix fwd_ancil test to pass if the socket options are not supported. 7303 730418 March 2010: Wouter 7305 - Fixed random numbers for port, interface and server selection. 7306 Removed very small bias. 7307 - Refer to the listing in unbound-control man page in the extended 7308 statistics entry in the unbound.conf man page. 7309 731016 March 2010: Wouter 7311 - Fix interface-automatic for OpenBSD: msg.controllen was too small, 7312 also assertions on ancillary data buffer. 7313 - check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO. 7314 - for NSEC3 check if signatures are cached. 7315 731615 March 2010: Wouter 7317 - unit test for util/regional.c. 7318 731912 March 2010: Wouter 7320 - Reordered configure checks so fork and -lnsl -lsocket checks are 7321 earlier, and thus later checks benefit from and do not hinder them. 7322 - iana portlist updated. 7323 - ldns tarball updated. 7324 - Fix python use when multithreaded. 7325 - Fix solaris python compile. 7326 - Include less in config.h and include per code file for ldns, ssl. 7327 732811 March 2010: Wouter 7329 - another memory allocation option: --enable-alloc-nonregional. 7330 exposes the regional allocations to other memory purifiers. 7331 - fix for memory alignment in struct sock_list allocation. 7332 - Fix for MacPorts ldns without ssl default, unbound checks if ldns 7333 has dnssec functionality and uses the builtin if not. 7334 - Fix daemonize on Solaris 10, it did not detach from terminal. 7335 - tag 1.4.3 created. 7336 - trunk is 1.4.4 in development. 7337 - spelling fix in validation error involving cnames. 7338 733910 March 2010: Wouter 7340 - --enable-alloc-lite works with test set. 7341 - portability in the testset: printf format conversions, prototypes. 7342 73439 March 2010: Wouter 7344 - tag 1.4.2 created. 7345 - trunk is 1.4.3 in development. 7346 - --enable-alloc-lite debug option. 7347 73488 March 2010: Wouter 7349 - iana portlist updated. 7350 73514 March 2010: Wouter 7352 - Fix crash in control channel code. 7353 73543 March 2010: Wouter 7355 - better casts in pipe code, brackets placed wrongly. 7356 - iana portlist updated. 7357 73581 March 2010: Wouter 7359 - make install depends on make all. 7360 - Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs. 7361 - --enable-checking: enables assertions but does not look nonproduction. 7362 - nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with 7363 nxdomain and nodata distinguished. 7364 - ldns tarball updated. 7365 - --disable-rpath fixed for libtool not found errors. 7366 - new fedora specfile from Fedora13 in contrib from Paul Wouters. 7367 736826 February 2010: Wouter 7369 - Fixup prototype for lexer cleanup in daemon code. 7370 - unbound-control list_stubs, list_forwards, list_local_zones and 7371 list_local_data. 7372 737324 February 2010: Wouter 7374 - Fix scrubber bug that potentially let NS records through. Reported 7375 by Amanda Constant. 7376 - Also delete potential poison references from additional. 7377 - Fix: no classification of a forwarder as lame, throw away instead. 7378 737923 February 2010: Wouter 7380 - libunbound ub_ctx_get_option() added. 7381 - unbound-control set_option and get_option commands. 7382 - iana portlist updated. 7383 738418 February 2010: Wouter 7385 - A little more strict DS scrubbing. 7386 - No more blacklisting of unresponsive servers, a 2 minute timeout 7387 is backed off to. 7388 - RD flag not enabled for dnssec-blacklisted tries, unless necessary. 7389 - pickup ldns compile fix, libdl for libcrypto. 7390 - log 'tcp connect: connection timed out' only in high verbosity. 7391 - unbound-control log_reopen command. 7392 - moved get_option code from unbound-checkconf to util/config_file.c 7393 739417 February 2010: Wouter 7395 - Disregard DNSKEY from authority section for chain of trust. 7396 DS records that are irrelevant to a referral scrubbed. Anti-poison. 7397 - iana portlist updated. 7398 739916 February 2010: Wouter 7400 - Check for 'no space left on device' (or other errors) when 7401 writing updated autotrust anchors and print errno to log. 7402 740315 February 2010: Wouter 7404 - Fixed the requery protection, the TTL was 0, it is now 900 seconds, 7405 hardcoded. We made the choice to send out more conservatively, 7406 protecting against an aggregate effect more than protecting a 7407 single user (from their own folly, perhaps in case of misconfig). 7408 740912 February 2010: Wouter 7410 - Re-query pattern changed on validation failure. To protect troubled 7411 authority servers, unbound caches a failure for the DNSKEY or DS 7412 records for the entire zone, and only retries that 900 seconds later. 7413 This implies that only a handful of packets are sent extra to the 7414 authority if the zone fails. 7415 741611 February 2010: Wouter 7417 - ldns tarball update for long label length syntax error fix. 7418 - iana portlist updated. 7419 74209 February 2010: Wouter 7421 - Fixup in compat snprintf routine, %f 1.02 and %g support. 7422 - include math.h for testbound test compile portability. 7423 74242 February 2010: Wouter 7425 - Updated url of IANA itar, interim trust anchor repository, in script. 7426 74271 February 2010: Wouter 7428 - iana portlist updated. 7429 - configure test for memcmp portability. 7430 743127 January 2010: Wouter 7432 - removed warning on format string in validator error log statement. 7433 - iana portlist updated. 7434 743522 January 2010: Wouter 7436 - libtool finish the install of unbound python dynamic library. 7437 743821 January 2010: Wouter 7439 - acx_nlnetlabs.m4 synchronised with nsd's version. 7440 744120 January 2010: Wouter 7442 - Fixup lookup trouble for parent-child domains on the first query. 7443 744414 January 2010: Wouter 7445 - Fixup ldns detection to also check for header files. 7446 744713 January 2010: Wouter 7448 - prefetch-key option that performs DNSKEY queries earlier in the 7449 validation process, and that could halve the latency on DNSSEC 7450 queries. It takes some extra processing (CPU, a cache is needed). 7451 745212 January 2010: Wouter 7453 - Fix unbound-checkconf for auto-trust-anchor-file present checks. 7454 74558 January 2010: Wouter 7456 - Fix for parent-child disagreement code which could have trouble 7457 when (a) ipv6 was disabled and (b) the TTL for parent and child 7458 were different. There were two bugs, the parent-side information 7459 is fixed to no longer block lookup of child side information and 7460 the iterator is fixed to no longer attempt to get ipv6 when it is 7461 not enabled and then give up in failure. 7462 - test and fixes to make prefetch actually store the answer in the 7463 cache. Considers some rrsets 'already expired' but does not allow 7464 overwriting of rrsets considered more secure. 7465 74667 January 2010: Wouter 7467 - Fixup python documentation (thanks Leo Vandewoestijne). 7468 - Work on cache prefetch feature. 7469 - Stats for prefetch, in log print stats, unbound-control stats 7470 and in unbound_munin plugin. 7471 74726 January 2010: Wouter 7473 - iana portlist updated. 7474 - bug#291: DNS wireformat max is 255. dname_valid allowed 256 length. 7475 - verbose output includes parent-side-address notion for lameness. 7476 - documented val-log-level: 2 setting in example.conf and man page. 7477 - change unbound-control-setup from 1024(sha1) to 1536(sha256). 7478 74791 January 2010: Wouter 7480 - iana portlist updated. 7481 748222 December 2009: Wouter 7483 - configure with newer libtool 2.2.6b. 7484 748517 December 2009: Wouter 7486 - review comments. 7487 - tag 1.4.1. 7488 - trunk to version 1.4.2. 7489 749015 December 2009: Wouter 7491 - Answer to qclass=ANY queries, with class IN contents. 7492 Test that validation also works. 7493 - updated ldns snapshot tarball with latest fixes (parsing records). 7494 749511 December 2009: Wouter 7496 - on IPv4 UDP turn off DF flag. 7497 749810 December 2009: Wouter 7499 - requirements.txt updated with design choice explanations. 7500 - Reading fixes: fix to set unlame when child confirms parent glue, 7501 and fix to avoid duplicate addresses in delegation point. 7502 - verify_rrsig routine checks expiration last. 7503 75049 December 2009: Wouter 7505 - Fix Bug#287(reopened): update of ldns tarball with fix for parse 7506 errors generated for domain names like '.example.com'. 7507 - Fix SOA excluded from negative DS responses. Reported by Hauke 7508 Lampe. The negative cache did not include proper SOA records for 7509 negative qtype DS responses which makes BIND barf on it, such 7510 responses are now only used internally. 7511 - Fix negative cache lookup of closestencloser check of DS type bit. 7512 75138 December 2009: Wouter 7514 - Fix for lookup of parent-child disagreement domains, where the 7515 parent-side glue works but it does not provide proper NS, A or AAAA 7516 for itself, fixing domains such as motorcaravanners.eu. 7517 - Feature: you can specify a port number in the interface: line, so 7518 you can bind the same interface multiple times at different ports. 7519 75207 December 2009: Wouter 7521 - Bug#287: Fix segfault when unbound-control remove nonexistent local 7522 data. Added check to tests. 7523 75241 December 2009: Wouter 7525 - Fix crash with module-config "iterator". 7526 - Added unit test that has "iterator" module-config. 7527 752830 November 2009: Wouter 7529 - bug#284: fix parse of # without end-of-line at end-of-file. 7530 753126 November 2009: Wouter 7532 - updated ldns with release candidate for version 1.6.3. 7533 - tag for 1.4.0 release. 7534 - 1.4.1 version in trunk. 7535 - Fixup major libtool version to 2 because of why_bogus change. 7536 It was 1:5:0 but should have been 2:0:0. 7537 753823 November 2009: Wouter 7539 - Patch from David Hubbard for libunbound manual page. 7540 - Fixup endless spinning in unbound-control stats reported by 7541 Attila Nagy. Probably caused by clock reversal. 7542 754320 November 2009: Wouter 7544 - contrib/split-itar.sh contributed by Tom Hendrikx. 7545 754619 November 2009: Wouter 7547 - better argument help for unbound-control. 7548 - iana portlist updated. 7549 755017 November 2009: Wouter 7551 - noted multiple entries for multiple domain names in example.conf. 7552 - iana portlist updated. 7553 755416 November 2009: Wouter 7555 - Fixed signer detection of CNAME responses without signatures. 7556 - Fix#282 libunbound memleak on error condition by Eric Sesterhenn. 7557 - Tests for CNAMEs to deeper trust anchors, secure and bogus. 7558 - svn tag 1.4.0rc1 made. 7559 756013 November 2009: Wouter 7561 - Fixed validation failure for CNAME to optout NSEC3 nodata answer. 7562 - unbound-host does not fail on type ANY. 7563 - Fixed wireparse failure to put RRSIGs together with data in some 7564 long ANY mix cases, which fixes validation failures. 7565 756612 November 2009: Wouter 7567 - iana portlist updated. 7568 - fix manpage errors reported by debian lintian. 7569 - review comments. 7570 - fixup very long vallog2 level error strings. 7571 757211 November 2009: Wouter 7573 - ldns tarball updated (to 1.6.2). 7574 - review comments. 7575 757610 November 2009: Wouter 7577 - Thanks to Surfnet found bug in new dnssec-retry code that failed 7578 to combine well when combined with DLV and a particular failure. 7579 - Fixed unbound-control -h output about argument optionality. 7580 - review comments. 7581 75825 November 2009: Wouter 7583 - lint fixes and portability tests. 7584 - better error text for multiple domain keys in one autotrust file. 7585 75862 November 2009: Wouter 7587 - Fix bug where autotrust does not work when started with a DS. 7588 - Updated GOST unit tests for unofficial algorithm number 249 7589 and DNSKEY-format changes in draft version -01. 7590 759129 October 2009: Wouter 7592 - iana portlist updated. 7593 - edns-buffer-size option, default 4096. 7594 - fixed do-udp: no. 7595 759628 October 2009: Wouter 7597 - removed abort on prealloc failure, error still printed but softfail. 7598 - iana portlist updated. 7599 - RFC 5702: RSASHA256 and RSASHA512 support enabled by default. 7600 - ldns tarball updated (which also enables rsasha256 support). 7601 760227 October 2009: Wouter 7603 - iana portlist updated. 7604 76058 October 2009: Wouter 7606 - please doxygen 7607 - add val-log-level print to corner case (nameserver.epost.bg). 7608 - more detail to errors from insecure delegation checks. 7609 - Fix double time subtraction in negative cache reported by 7610 Amanda Constant and Hugh Mahon. 7611 - Made new validator error string available from libunbound for 7612 applications. It is in result->why_bogus, a zero-terminated string. 7613 unbound-host prints it by default if a result is bogus. 7614 Also the errinf is public in module_qstate (for other modules). 7615 76167 October 2009: Wouter 7617 - retry for validation failure in DS and prime results. Less mem use. 7618 unit test. Provisioning in other tests for requeries. 7619 - retry for validation failure in DNSKEY in middle of chain of trust. 7620 unit test. 7621 - retry for empty non terminals in chain of trust and unit test. 7622 - Fixed security bug where the signatures for NSEC3 records were not 7623 checked when checking for absence of DS records. This could have 7624 enabled the substitution of an insecure delegation. 7625 - moved version number to 1.4.0 because of 1.3.4 release with only 7626 the NSEC3 patch from the entry above. 7627 - val-log-level: 2 shows extended error information for validation 7628 failures, but still one (longish) line per failure. For example: 7629 validation failure <example.com. DNSKEY IN>: signature expired from 7630 192.0.2.4 for trust anchor example.com. while building chain of trust 7631 validation failure <www.example.com. A IN>: no signatures from 7632 192.0.2.6 for key example.com. while building chain of trust 7633 76346 October 2009: Wouter 7635 - Test set updated to provide additional ns lookup result. 7636 The retry would attempt to fetch the data from other nameservers 7637 for bogus data, and this needed to be provisioned in the tests. 7638 76395 October 2009: Wouter 7640 - first validation failure retry code. Retries for data failures. 7641 And unit test. 7642 76432 October 2009: Wouter 7644 - improve 5011 modularization. 7645 - fix unbound-host so -d can be given before -C. 7646 - iana portlist updated. 7647 764828 September 2009: Wouter 7649 - autotrust-anchor-file can read multiline input and $ORIGIN. 7650 - prevent integer overflow in holddown calculation. review fixes. 7651 - fixed race condition in trust point revocation. review fix. 7652 - review fixes to comments, removed unused code. 7653 765425 September 2009: Wouter 7655 - so-rcvbuf: 4m option added. Set this on large busy servers to not 7656 drop the occasional packet in spikes due to full socket buffers. 7657 netstat -su keeps a counter of UDP dropped due to full buffers. 7658 - review of validator/autotrust.c, small fixes and comments. 7659 766023 September 2009: Wouter 7661 - 5011 query failed counts verification failures, not lookup failures. 7662 - 5011 probe failure handling fixup. 7663 - test unbound reading of original autotrust data. 7664 The metadata per-key, such as key state (PENDING, MISSING, VALID) is 7665 picked up, otherwise performs initial probe like usual. 7666 766722 September 2009: Wouter 7668 - autotrust test with algorithm rollover, new ordering of checks 7669 assists in orderly rollover. 7670 - autotrust test with algorithm rollover to unknown algorithm. 7671 checks if new keys are supported before adding them. 7672 - autotrust test with trust point revocation, becomes unsigned. 7673 - fix DNSSEC-missing-signature detection for minimal responses 7674 for qtype DNSKEY (assumes DNSKEY occurs at zone apex). 7675 767618 September 2009: Wouter 7677 - autotrust tests, fix trustpoint timer deletion code. 7678 fix count of valid anchors during missing remove. 7679 - autotrust: pick up REVOKE even if not signed with known other keys. 7680 768117 September 2009: Wouter 7682 - fix compile of unbound-host when --enable-alloc-checks. 7683 - Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis. 7684 - Manual page fixes reported by Tony Finch. 7685 768616 September 2009: Wouter 7687 - Fix memory leak reported by Tao Ma. 7688 - Fix memstats test tool for log-time-ascii log format. 7689 769015 September 2009: Wouter 7691 - iana portlist updated. 7692 769310 September 2009: Wouter 7694 - increased MAXSYSLOGLEN so .bg key can be printed in debug output. 7695 - use linebuffering for log-file: output, this can be significantly 7696 faster than the previous fflush method and enable some class of 7697 resolvers to use high verbosity (for short periods). 7698 Not on windows, because line buffering does not work there. 7699 77009 September 2009: Wouter 7701 - Fix bug where DNSSEC-bogus messages were marked with too high TTL. 7702 The RRsets would still expire at the normal time, but this would 7703 keep messages bogus in the cache for too long. 7704 - regression test for that bug. 7705 - documented that load_cache is meant for debugging. 7706 77078 September 2009: Wouter 7708 - fixup printing errors when load_cache, they were printed to the 7709 SSL connection which broke, now to the log. 7710 - new ldns - with fixed parse of large SOA values. 7711 77127 September 2009: Wouter 7713 - autotrust testbound scenarios. 7714 - autotrust fix that failure count is written to file. 7715 - autotrust fix that keys may become valid after add holddown time 7716 alone, before the probe returns. 7717 77184 September 2009: Wouter 7719 - Changes to make unbound work with libevent-2.0.3 alpha. (in 7720 configure detection due to new ssl dependency in libevent) 7721 - do not call sphinx for documentation when python is disabled. 7722 - remove EV_PERSIST from libevent timeout code to make the code 7723 compatible with the libevent-2.0. Works with older libevent too. 7724 - fix memory leak in python code. 7725 77263 September 2009: Wouter 7727 - Got a patch from Luca Bruno for libunbound support on windows to 7728 pick up the system resolvconf nameservers and hosts there. 7729 - included ldns updated (enum warning fixed). 7730 - makefile fix for parallel makes. 7731 - Patch from Zdenek Vasicek and Attila Nagy for using the source IP 7732 from python scripts. See pythonmod/examples/resip.py. 7733 - doxygen comment fixes. 7734 77352 September 2009: Wouter 7736 - TRAFFIC keyword for testbound. Simplifies test generation. 7737 ${range lower val upper} to check probe timeout values. 7738 - test with 5011-prepublish rollover and revocation. 7739 - fix revocation of RR for autotrust, stray exclamation mark. 7740 77411 September 2009: Wouter 7742 - testbound variable arithmetic. 7743 - autotrust probe time is randomised. 7744 - autotrust: the probe is active and does not fetch from cache. 7745 774631 August 2009: Wouter 7747 - testbound variable processing. 7748 774928 August 2009: Wouter 7750 - fixup unbound-control lookup to print forward and stub servers. 7751 775227 August 2009: Wouter 7753 - autotrust: mesh answer callback is empty. 7754 775526 August 2009: Wouter 7756 - autotrust probing. 7757 - iana portlist updated. 7758 775925 August 2009: Wouter 7760 - fixup memleak in trust anchor unsupported algorithm check. 7761 - iana portlist updated. 7762 - autotrust options: add-holddown, del-holddown, keep-missing. 7763 - autotrust store revoked status of trust points. 7764 - ctime_r compat definition. 7765 - detect yylex_destroy() in configure. 7766 - detect SSL_get_compression_methods declaration in configure. 7767 - fixup DS lookup at anchor point with unsigned parent. 7768 - fixup DLV lookup for DS queries to unsigned domains. 7769 777024 August 2009: Wouter 7771 - cleaner memory allocation on exit. autotrust test routines. 7772 - free all memory on program exit, fix for ssl and flex. 7773 777421 August 2009: Wouter 7775 - autotrust: debug routines. Read,write and conversions work. 7776 777720 August 2009: Wouter 7778 - autotrust: save and read trustpoint variables. 7779 778019 August 2009: Wouter 7781 - autotrust: state table updates. 7782 - iana portlist updated. 7783 778417 August 2009: Wouter 7785 - autotrust: process events. 7786 778717 August 2009: Wouter 7788 - Fix so that servers are only blacklisted if they fail to reply 7789 to 16 queries in a row and the timeout gets above 2 minutes. 7790 - autotrust work, split up DS verification of DNSKEYs. 7791 779214 August 2009: Wouter 7793 - unbound-control lookup prints out infra cache information, like RTT. 7794 - Fix bug in DLV lookup reported by Amanda from Secure64. 7795 It could sometimes wrongly classify a domain as unsigned, which 7796 does not give the AD bit on replies. 7797 779813 August 2009: Wouter 7799 - autotrust read anchor files. locked trust anchors. 7800 780112 August 2009: Wouter 7802 - autotrust import work. 7803 780411 August 2009: Wouter 7805 - Check for openssl compatible with gost if enabled. 7806 - updated unit test for GOST=211 code. 7807 Nicer naming of test files. 7808 - iana portlist updated. 7809 78107 August 2009: Wouter 7811 - call OPENSSL_config() in unbound and unit test so that the 7812 operator can use openssl.cnf for configuration options. 7813 - removed small memory leak from config file reader. 7814 78156 August 2009: Wouter 7816 - configure --enable-gost for GOST support, experimental 7817 implementation of draft-dolmatov-dnsext-dnssec-gost-01. 7818 - iana portlist updated. 7819 - ldns tarball updated (with GOST support). 7820 78215 August 2009: Wouter 7822 - trunk moved to 1.3.4. 7823 78244 August 2009: Wouter 7825 - Added test that the examples from draft rsasha256-14 verify. 7826 - iana portlist updated. 7827 - tagged 1.3.3 7828 78293 August 2009: Wouter 7830 - nicer warning when algorithm not supported, tells you to upgrade. 7831 - iana portlist updated. 7832 783327 July 2009: Wouter 7834 - Updated unbound-cacti contribution from Dmitriy Demidov, with 7835 the queue statistics displayed in its own graph. 7836 - iana portlist updated. 7837 783822 July 2009: Wouter 7839 - Fix bug found by Michael Tokarev where unbound would try to 7840 prime the root servers even though forwarders are configured for 7841 the root. 7842 - tagged 1.3.3rc1 7843 784421 July 2009: Wouter 7845 - Fix server selection, so that it waits for open target queries when 7846 faced with lameness. 7847 784820 July 2009: Wouter 7849 - Ignore transient sendto errors, no route to host, and host, net down. 7850 - contrib/update-anchor.sh has -r option for root-hints. 7851 - feature val-log-level: 1 prints validation failures so you can 7852 keep track of them during dnssec deployment. 7853 785416 July 2009: Wouter 7855 - fix replacement malloc code. Used in crosscompile. 7856 - makedist -w creates crosscompiled setup.exe on fedora11. 7857 785815 July 2009: Wouter 7859 - dependencies for compat items, for crosscompile. 7860 - mingw32 crosscompile changes, dependencies and zipfile creation. 7861 and with System.dll from the windows NSIS you can make setup.exe. 7862 - package libgcc_s_sjlj exception handler for NSISdl.dll. 7863 786414 July 2009: Wouter 7865 - updated ldns tarball for solaris x64 compile assistance. 7866 - no need to define RAND_MAX from config.h. 7867 - iana portlist updated. 7868 - configure changes and ldns update for mingw32 crosscompile. 7869 787013 July 2009: Wouter 7871 - Fix for crash at start on windows. 7872 - tag for release 1.3.2. 7873 - trunk has version 1.3.3. 7874 - Fix for ID bits on windows to use all 16. RAND_MAX was not 7875 defined like you'd expect on mingw. Reported by Mees de Roo. 7876 78779 July 2009: Wouter 7878 - tag for release 1.3.1. 7879 - trunk has version 1.3.2. 7880 78817 July 2009: Wouter 7882 - iana portlist updated. 7883 78846 July 2009: Wouter 7885 - prettier error handling in SSL setup. 7886 - makedist.sh uname fix (same as ldns). 7887 - updated fedora spec file. 7888 78893 July 2009: Wouter 7890 - fixup linking when ldnsdir is "". 7891 789230 June 2009: Wouter 7893 - more lenient truncation checks. 7894 789529 June 2009: Wouter 7896 - ldns trunk r2959 imported as tarball, because of solaris cc compile 7897 support for c99. r2960 for better configure. 7898 - better wrongly_truncated check. 7899 - On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to 7900 avoid dropped packets at routers. 7901 790226 June 2009: Wouter 7903 - Fix EDNS fallback when EDNS works for short answers but long answers 7904 are dropped. 7905 790622 June 2009: Wouter 7907 - fixup iter priv strict aliasing while preserving size of sockaddr. 7908 - iana portlist updated. (one less port allocated, one more fraction 7909 of a bit for security!) 7910 - updated fedora specfile in contrib from Paul Wouters. 7911 791219 June 2009: Wouter 7913 - Fixup strict aliasing warning in iter priv code. 7914 and config_file code. 7915 - iana portlist updated. 7916 - harden-referral-path: handle cases where NS is in answer section. 7917 791818 June 2009: Wouter 7919 - Fix of message parse bug where (specifically) an NSEC and RRSIG 7920 in the wrong order would be parsed, but put wrongly into internal 7921 structures so that later validation would fail. 7922 - Extreme lenience for wrongly truncated replies where a positive 7923 reply has an NS in the authority but no signatures. They are 7924 turned into minimal responses with only the (secure) answer. 7925 - autoconf 2.63 for configure. 7926 - python warnings suppress. Keep python API away from header files. 7927 792817 June 2009: Wouter 7929 - CREDITS entry for cz.nic, sponsoring a 'summer of code' that was 7930 used for the python code in unbound. (http://www.nic.cz/vip/ in cz). 7931 793216 June 2009: Wouter 7933 - Fixup opportunistic target query generation to it does not 7934 generate queries that are known to fail. 7935 - Touchup on munin total memory report. 7936 - messages picked out of the cache by the iterator are checked 7937 if their cname chain is still correct and if validation status 7938 has to be reexamined. 7939 794015 June 2009: Wouter 7941 - iana portlist updated. 7942 794314 June 2009: Wouter 7944 - Fixed bug where cached responses would lose their security 7945 status on second validation, which especially impacted dlv 7946 lookups. Reported by Hauke Lampe. 7947 794813 June 2009: Wouter 7949 - bug #254. removed random whitespace from example.conf. 7950 795112 June 2009: Wouter 7952 - Fixup potential wrong NSEC picked out of the cache. 7953 - If unfulfilled callbacks are deleted they are called with an error. 7954 - fptr wlist checks for mesh callbacks. 7955 - fwd above stub in configuration works. 7956 795711 June 2009: Wouter 7958 - Fix queries for type DS when forward or stub zones are there. 7959 They are performed to higherup domains, and thus treated as if 7960 going to higher zones when looking up the right forward or stub 7961 server. This makes a stub pointing to a local server that has 7962 a local view of example.com signed with the same keys as are 7963 publicly used work. Reported by Johan Ihren. 7964 - Added build-unbound-localzone-from-hosts.pl to contrib, from 7965 Dennis DeDonatis. It converts /etc/hosts into config statements. 7966 - same thing fixed for forward-zone and DS, chain of trust from 7967 public internet into the forward-zone works now. Added unit test. 7968 79699 June 2009: Wouter 7970 - openssl key files are opened apache-style, when user is root and 7971 before chrooting. This makes permissions on remote-control key 7972 files easier to set up. Fixes bug #251. 7973 - flush_type and flush_name remove msg cache entries. 7974 - codereview - dp copy bogus setting fix. 7975 79768 June 2009: Wouter 7977 - Removed RFC5011 REVOKE flag support. Partial 5011 support may cause 7978 inadvertant behaviour. 7979 - 1.3.0 tarball for release created. 7980 - 1.3.1 development in svn trunk. 7981 - iana portlist updated. 7982 - fix lint from complaining on ldns/sha.h. 7983 - help compiler figure out aliasing in priv_rrset_bad() routine. 7984 - fail to configure with python if swig is not found. 7985 - unbound_munin_ in contrib uses ps to show rss if sbrk does not work. 7986 79873 June 2009: Wouter 7988 - fixup bad free() when wrongly encoded DSA signature is seen. 7989 Reported by Paul Wouters. 7990 - review comments from Matthijs. 7991 79922 June 2009: Wouter 7993 - --enable-sha2 option. The draft rsasha256 changed its algorithm 7994 numbers too often. Therefore it is more prudent to disable the 7995 RSASHA256 and RSASHA512 support by default. 7996 - ldns trunk included as new tarball. 7997 - recreated the 1.3.0 tag in svn. rc1 tarball generated at this point. 7998 799929 May 2009: Wouter 8000 - fixup doc bug in README reported by Matthew Dempsky. 8001 800228 May 2009: Wouter 8003 - update iana port list 8004 - update ldns lib tarball 8005 800627 May 2009: Wouter 8007 - detect lack of IPv6 support on XP (with a different error code). 8008 - Fixup a crash-on-exit which was triggered by a very long queue. 8009 Unbound would try to re-use ports that came free, but this is 8010 of course not really possible because everything is deleted. 8011 Most easily triggered on XP (not Vista), maybe because of the 8012 network stack encouraging large messages backlogs. 8013 - change in debug statements. 8014 - Fixed bug that could cause a crash if root prime failed when there 8015 were message backlogs. 8016 801726 May 2009: Wouter 8018 - Thanks again to Brett Carr, found an assertion that was not true. 8019 Assertion checked if recursion parent query still existed. 8020 802129 April 2009: Wouter 8022 - Thanks to Brett Carr, caught windows resource leak, use 8023 closesocket() and not close() on sockets or else the network stack 8024 starts to leak handles. 8025 - Removed usage of windows Mutex because windows cannot handle enough 8026 mutexes open. Provide own mutex implementation using primitives. 8027 802828 April 2009: Wouter 8029 - created svn tag for 1.3.0. 8030 803127 April 2009: Wouter 8032 - optimised cname from cache. 8033 - ifdef windows functions in testbound. 8034 803523 April 2009: Wouter 8036 - fix for threadsafety in solaris thr_key_create() in tests. 8037 - iana portlist updated. 8038 - fix pylib test for Darwin. 8039 - fix pymod test for Darwin and a python threading bug in pymod init. 8040 - check python >= 2.4 in configure. 8041 - -ldl check for libcrypto 1.0.0beta. 8042 804321 April 2009: Wouter 8044 - fix for build outside sourcedir. 8045 - fix for configure script swig detection. 8046 804717 April 2009: Wouter 8048 - Fix reentrant in minievent handler for unix. Could have resulted 8049 in spurious event callbacks. 8050 - timers do not take up a fd slot for winsock handler. 8051 - faster fix for winsock reentrant check. 8052 - fix rsasha512 unit test for new (interim) algorithm number. 8053 - fix test:ldns doesn't like DOS line endings in keyfiles on unix. 8054 - fix compile warning on ubuntu (configlexer fwrite return value). 8055 - move python include directives into CPPFLAGS instead of CFLAGS. 8056 805716 April 2009: Wouter 8058 - winsock event handler exit very quickly on signal, even if 8059 under heavy load. 8060 - iana portlist updated. 8061 - fixup windows winsock handler reentrant problem. 8062 806314 April 2009: Wouter 8064 - bug #245: fix munin plugin, perform cleanup of stale lockfiles. 8065 - makedist.sh; better help text. 8066 - cache-min-ttl option and tests. 8067 - mingw detect error condition on TCP sockets (NOTCONN). 8068 80699 April 2009: Wouter 8070 - Fix for removal of RSASHA256_NSEC3 protonumber from ldns. 8071 - ldns tarball updated. 8072 - iana portlist update. 8073 - detect GOST support in openssl-1.0.0-beta1, and fix compile problem 8074 because that openssl defines the name STRING for itself. 8075 80766 April 2009: Wouter 8077 - windows compile fix. 8078 - Detect FreeBSD jail without ipv6 addresses assigned. 8079 - python libunbound wrapper unit test. 8080 - installs the following files. Default is to not build them. 8081 from configure --with-pythonmodule: 8082 /usr/lib/python2.x/site-packages/unboundmodule.py 8083 from configure --with-pyunbound: 8084 /usr/lib/python2.x/site-packages/unbound.py 8085 /usr/lib/python2.x/site-packages/_unbound.so* 8086 The example python scripts (pythonmod/examples and 8087 libunbound/python/examples) are not installed. 8088 - python invalidate routine respects packed rrset ids and locks. 8089 - clock skew checks in unbound, config statements. 8090 - nxdomain ttl considerations in requirements.txt 8091 80923 April 2009: Wouter 8093 - Fixed a bug that caused messages to be stored in the cache too 8094 long. Hard to trigger, but NXDOMAINs for nameservers or CNAME 8095 targets have been more vulnerable to the TTL miscalculation bug. 8096 - documentation test fixed for python addition. 8097 80982 April 2009: Wouter 8099 - pyunbound (libunbound python plugin) compiles using libtool. 8100 - documentation for pythonmod and pyunbound is generated in doc/html. 8101 - iana portlist updated. 8102 - fixed bug in unbound-control flush_zone where it would not flush 8103 every message in the target domain. This especially impacted 8104 NXDOMAIN messages which could remain in the cache regardless. 8105 - python module test package. 8106 81071 April 2009: Wouter 8108 - suppress errors when trying to contact authority servers that gave 8109 ipv6 AAAA records for their nameservers with ipv4 mapped contents. 8110 Still tries to do so, could work when deployed in intranet. 8111 Higher verbosity shows the error. 8112 - new libunbound calls documented. 8113 - pyunbound in libunbound/python. Removed compile warnings. 8114 Makefile to make it. 8115 811630 March 2009: Wouter 8117 - Fixup LDFLAGS from libevent sourcedir compile configure restore. 8118 - Fixup so no non-absolute rpaths are added. 8119 - Fixup validation of RRSIG queries, they are let through. 8120 - read /dev/random before chroot 8121 - checkconf fix no python checks when no python module enabled. 8122 - fix configure, pthread first, so other libs do not change outcome. 8123 812427 March 2009: Wouter 8125 - nicer -h output. report linked libraries and modules. 8126 - prints modules in intuitive order (config file friendly). 8127 - python compiles easily on BSD. 8128 812926 March 2009: Wouter 8130 - ignore swig varargs warnings with gcc. 8131 - remove duplicate example.conf text from python example configs. 8132 - outofdir compile fix for python. 8133 - pyunbound works. 8134 - print modules compiled in on -h. manpage. 8135 813625 March 2009: Wouter 8137 - initial import of the python contribution from Zdenek Vasicek and 8138 Marek Vavrusa. 8139 - pythonmod in Makefile; changes to remove warnings/errors for 1.3.0. 8140 814124 March 2009: Wouter 8142 - more neat configure.ac. Removed duplicate config.h includes. 8143 - neater config.h.in. 8144 - iana portlist updated. 8145 - fix util/configlexer.c and solaris -std=c99 flag. 8146 - fix postcommit aclocal errors. 8147 - spaces stripped. Makefile cleaner, /usr omitted from -I, -L, -R. 8148 - swap order of host detect and libtool generation. 8149 815023 March 2009: Wouter 8151 - added launchd plist example file for MacOSX to contrib. 8152 - deprecation test for daemon(3). 8153 - moved common configure actions to m4 include, prettier Makefile. 8154 815520 March 2009: Wouter 8156 - bug #239: module-config entries order is important. Documented. 8157 - build fix for test asynclook. 8158 815919 March 2009: Wouter 8160 - winrc/README.txt dos-format text file. 8161 - iana portlist updated. 8162 - use _beginthreadex() when available (performs stack alignment). 8163 - defaults for windows baked into configure.ac (used if on mingw). 8164 816518 March 2009: Wouter 8166 - Added tests, unknown algorithms become insecure. fallback works. 8167 - Fix for and test for unknown algorithms in a trust anchor 8168 definition. Trust anchors with no supported algos are ignored. 8169 This means a (higher)DS or DLV entry for them could succeed, and 8170 otherwise they are treated as insecure. 8171 - domain-insecure: "example.com" statement added. Sets domain 8172 insecure regardless of chain of trust DSs or DLVs. The inverse 8173 of a trust-anchor. 8174 817517 March 2009: Wouter 8176 - unit test for unsupported algorithm in anchor warning. 8177 - fixed so queries do not fail on opportunistic target queries. 8178 817916 March 2009: Wouter 8180 - fixup diff error printout in contrib/update-itar.sh. 8181 - added contrib/unbound_cacti for statistics support in cacti, 8182 contributed by Dmitriy Demidov. 8183 818413 March 2009: Wouter 8185 - doxygen and lex/yacc on linux. 8186 - strip update-anchor on makedist -w. 8187 - fix testbound on windows. 8188 - default log to syslog for windows. 8189 - uninstaller can stop unbound - changed text on it to reflect that. 8190 - remove debugging from windows 'cron' actions. 8191 819212 March 2009: Wouter 8193 - log to App.logs on windows prints executable identity. 8194 - fixup tests. 8195 - munin plugin fix benign locking error printout. 8196 - anchor-update for windows, called every 24 hours; unbound reloads. 8197 819811 March 2009: Wouter 8199 - winsock event handler resets WSAevents after signalled. 8200 - winsock event handler tests if signals are really signalled. 8201 - install and service with log to file works on XP and Vista on 8202 default install location. 8203 - on windows logging to the Application logbook works (as a service). 8204 - fix RUN_DIR on windows compile setting in makedist. 8205 - windows registry has Software\Unbound\ConfigFile element. 8206 If does not exist, the default is used. The -c switch overrides it. 8207 - fix makedist version cleanup function. 8208 820910 March 2009: Wouter 8210 - makedist -w strips out old rc.. and snapshot info from version. 8211 - setup.exe starts and stops unbound after install, before uninstall. 8212 - unbound-checkconf recognizes absolute pathnames on windows (C:...). 8213 82149 March 2009: Wouter 8215 - Nullsoft NSIS installer creation script. 8216 82175 March 2009: Wouter 8218 - fixup memory leak introduced on 18feb in mesh reentrant fix. 8219 82203 March 2009: Wouter 8221 - combined icon with 16x16(4) 32x32(4) 48x48(8) 64x64(8). 8222 - service works on xp/vista, no config necessary (using defaults). 8223 - windows registry settings. 8224 82252 March 2009: Wouter 8226 - fixup --export-symbols to be -export-symbls for libtool. 8227 This should fix extraneous symbols exported from libunbound. 8228 Thanks to Ondrej Sury and Robert Edmonds for finding it. 8229 - iana portlist updated. 8230 - document FAQ entry on stub/forward zones and default blocking. 8231 - fix asynclook test app for libunbound not exporting symbols. 8232 - service install and remove utils that work with vista UAC. 8233 823427 February 2009: Wouter 8235 - Fixup lexer, to not give warnings about fwrite. Appeared in 8236 new lexer features. 8237 - makedistro functionality for mingw. Has RC support. 8238 - support spaces and backslashes in configured defaults paths. 8239 - register, deregister in service control manager. 8240 824125 February 2009: Wouter 8242 - windres usage for application resources. 8243 824424 February 2009: Wouter 8245 - isc moved their dlv key download location. 8246 - fixup warning on vista/mingw. 8247 - makedist -w for window zip distribution first version. 8248 824920 February 2009: Wouter 8250 - Fixup contrib/update-itar.sh, the exit codes 1 and 0 were swapped. 8251 Nicer script layout. Added url to site in -h output. 8252 825319 February 2009: Wouter 8254 - unbound-checkconf and unbound print warnings when trust anchors 8255 have unsupported algorithms. 8256 - added contrib/update-itar.sh This script is similar to 8257 update-anchor.sh, and updates from the IANA ITAR repository. 8258 You can provide your own PGP key and trust repo, or can use the 8259 builtin. The program uses wget and gpg to work. 8260 - iana portlist updated. 8261 - update-itar.sh: using ftp:// urls because https godaddy certificate 8262 is not available everywhere and then gives fatal errors. The 8263 security is provided by pgp signature. 8264 826518 February 2009: Wouter 8266 - more cycle detection. Also for target queries. 8267 - fixup bug where during deletion of the mesh queries the callbacks 8268 that were reentrant caused assertion failures. Keep the mesh in 8269 a reentrant safe state. Affects libunbound, reload of server, 8270 on quit and flush_requestlist. 8271 - iana portlist updated. 8272 827313 February 2009: Wouter 8274 - forwarder information now per-thread duplicated. 8275 This keeps it read only for speed, with no locking necessary. 8276 - forward command for unbound control to change forwarders to use 8277 on the fly. 8278 - document that unbound-host reads no config file by default. 8279 - updated iana portlist. 8280 828112 February 2009: Wouter 8282 - call setusercontext if available (on BSD). 8283 - small refactor of stats clearing. 8284 - #227: flush_stats feature for unbound-control. 8285 - stats_noreset feature for unbound-control. 8286 - flush_requestlist feature for unbound-control. 8287 - libunbound version upped API (was changed 5 feb). 8288 - unbound-control status shows if root forwarding is in use. 8289 - slightly nicer memory management in iter-fwd code. 8290 829110 February 2009: Wouter 8292 - keys with rfc5011 REVOKE flag are skipped and not considered when 8293 validating data. 8294 - iana portlist updated 8295 - #226: dump_requestlist feature for unbound-control. 8296 82976 February 2009: Wouter 8298 - contrib contains specfile for fedora 1.2.1 (from Paul Wouters). 8299 - iana portlist updated. 8300 - fixup EOL in include directive (reported by Paul Wouters). 8301 You can no longer specify newlines in the names of included files. 8302 - config parser changed. Gives some syntax errors closer to where they 8303 occurred. Does not enforce a space after keyword anymore. 8304 Does not allow literal newlines inside quoted strings anymore. 8305 - verbosity level 5 logs customer IP for new requestlist entries. 8306 - test fix, lexer and cancel test. 8307 - new option log-time-ascii: yes if you enable it prints timestamps 8308 in the log file as Feb 06 13:45:26 (like syslog does). 8309 - detect event_base_new in libevent-1.4.1 and later and use it. 8310 - #231 unbound-checkconf -o option prints that value from config file. 8311 Useful for scripting in management scripts and the like. 8312 83135 February 2009: Wouter 8314 - ldns 1.5.0 rc as tarball included. 8315 - 1.3.0 development continues: 8316 change in libunbound API: ub_cancel can return an error, that 8317 the async_id did not exist, or that it was already delivered. 8318 The result could have been delivered just before the cancel 8319 routine managed to acquire the lock, so a caller may get the 8320 result at the same time they call cancel. For this case, 8321 ub_cancel tries to return an error code. 8322 Fixes race condition in ub_cancel() libunbound function. 8323 - MacOSX Leopard cleaner text output from configure. 8324 - initgroups(3) is called to drop secondary group permissions, if 8325 applicable. 8326 - configure option --with-ldns-builtin forces the use of the 8327 inluded ldns package with the unbound source. The -I include 8328 is put before the others, so it avoids bad include files from 8329 an older ldns install. 8330 - daemon(3) posix call is used when available. 8331 - testbound test for older fix added. 8332 83334 February 2009: Wouter 8334 - tag for release 1.2.1. 8335 - trunk setup for 1.3.0 development. 8336 83373 February 2009: Wouter 8338 - noted feature requests in doc/TODO. 8339 - printout more detailed errors on ssl certificate loading failures. 8340 - updated IANA portlist. 8341 834216 January 2009: Wouter 8343 - more quiet about ipv6 network failures, i.e. when ipv6 is not 8344 available (network unreachable). Debug still printed on high 8345 verbosity. 8346 - unbound-host -4 and -6 options. Stops annoying ipv6 errors when 8347 debugging with unbound-host -4 -d ... 8348 - more cycle detection for NS-check, addr-check, root-prime and 8349 stub-prime queries in the iterator. Avoids possible deadlock 8350 when priming fails. 8351 835215 January 2009: Wouter 8353 - bug #229: fixup configure checks for compilation with Solaris 8354 Sun cc compiler, ./configure CC=/opt/SUNWspro/bin/cc 8355 - fixup suncc warnings. 8356 - fix bug where unbound could crash using libevent 1.3 and older. 8357 - update testset for recent retry change. 8358 835914 January 2009: Wouter 8360 - 1.2.1 feature: negative caching for failed queries. 8361 Queries that failed are cached for 5 seconds (NORR_TTL). 8362 If the failure is local, like out of memory, it is not cached. 8363 - the TTL comparison for the cache used different comparisons, 8364 causing many cache responses that used the iterator and validator 8365 state machines unnecessarily. 8366 - retry from 4 to 5 so that EDNS drop retry is part of the first 8367 query resolve attempt, and cached error does not stop EDNS fallback. 8368 - remove debug prints that protect against bad referrals. 8369 - honor QUIET=no on make commandline (or QUIET=yes ). 8370 837113 January 2009: Wouter 8372 - fixed bug in lameness marking, removed printouts. 8373 - find NS rrset more cleanly for qtype NS. 8374 - Moved changes to 1.2.0 for release. Thanks to Mark Zealey for 8375 reporting and logs. 8376 - 1.2.1 feature: stops resolving AAAAs promiscuously when they 8377 are in the negative cache. 8378 837912 January 2009: Wouter 8380 - fixed bug in infrastructure lameness cache, did not lowercase 8381 name of zone to hash when setting lame. 8382 - lameness debugging printouts. 8383 83849 January 2009: Wouter 8385 - created svn tag for 1.2.0 release. 8386 - svn trunk contains 1.2.1 version number. 8387 - iana portlist updated for todays list. 8388 - removed debug print. 8389 83908 January 2009: Wouter 8391 - new version of ldns-trunk (today) included as tarball, fixed 8392 bug #224, building with -j race condition. 8393 - remove possible race condition in the test for race conditions. 8394 83957 January 2009: Wouter 8396 - version 1.2.0 in preparation. 8397 - feature to allow wildcards (*, ?, [], {}. ~) in trusted-keys-file 8398 statements. (Adapted from patch by Paul Wouters). 8399 - typo fix and iana portlist updated. 8400 - porting testsuite; unused var warning, and type fixup. 8401 84026 January 2009: Wouter 8403 - fixup packet-of-death when compiled with --enable-debug. 8404 A malformed packet could cause an internal assertion failure. 8405 - added test for HINFO canonicalisation behaviour. 8406 - fixup reported problem with transparent local-zone data where 8407 queries with different type could get nxdomain. Now queries 8408 with a different name get resolved normally, with different type 8409 get a correct NOERROR/NODATA answer. 8410 - HINFO no longer downcased for validation, making unbound compatible 8411 with bind and ldns. 8412 - fix reading included config files when chrooted. 8413 Give full path names for include files. 8414 Relative path names work if the start dir equals the working dir. 8415 - fix libunbound message transport when no packet buffer is available. 8416 84175 January 2009: Wouter 8418 - fixup getaddrinfo failure handling for remote control port. 8419 - added L.ROOT-SERVERS.NET. AAAA 2001:500:3::42 to builtin root hints. 8420 - fixup so it works with libev-3.51 from http://dist.schmorp.de/libev/ 8421 - comm_timer_set performs base_set operation after event_add. 8422 842318 December 2008: Wouter 8424 - fixed bug reported by Duane Wessels: error in DLV lookup, would make 8425 some zones that had correct DLV keys as insecure. 8426 - follows -rc makedist from ldns changes (no _rc). 8427 - ldns tarball updated with 1.4.1rc for DLV unit test. 8428 - verbose prints about recursion lame detection and server selection. 8429 - fixup BSD port for infra host storage. It hashed wrongly. 8430 - fixup makedist snapshot name generation. 8431 - do not reopen syslog to avoid dev/log dependency. 8432 843317 December 2008: Wouter 8434 - follows ldns makedist.sh. -rc option. autom4te dir removed. 8435 - unbound-control status command. 8436 - extended statistics has a number of ipv6 queries counter. 8437 contrib/unbound_munin_ was updated to draw ipv6 in the hits graph. 8438 843916 December 2008: Wouter 8440 - follow makedist improvements from ldns, for maintainers prereleases. 8441 - snapshot version uses _ not - to help rpm distinguish the 8442 version number. 8443 844411 December 2008: Wouter 8445 - better fix for bug #219: use LOG_NDELAY with openlog() call. 8446 Thanks to Tamas Tevesz. 8447 84489 December 2008: Wouter 8449 - bug #221 fixed: unbound checkconf checks if key files exist if 8450 remote control is enabled. Also fixed NULL printf when not chrooted. 8451 - iana portlist updated. 8452 84533 December 2008: Wouter 8454 - Fix problem reported by Jaco Engelbrecht where unbound-control stats 8455 freezes up unbound if this was compiled without threading, and 8456 was using multiple processes. 8457 - iana portlist updated. 8458 - test for remote control with interprocess communication. 8459 - created command distribution mechanism so that remote control 8460 commands other than 'stats' work on all processes in a nonthreaded 8461 compiled version. dump/load cache work, on the first process. 8462 - fixup remote control local_data addition memory corruption bug. 8463 84641 December 2008: Wouter 8465 - SElinux policy files in contrib/selinux for the unbound daemon, 8466 by Paul Wouters and Adam Tkac. 8467 846825 November 2008: Wouter 8469 - configure complains when --without-ssl is given (bug #220). 8470 - skip unsupported feature tests on vista/mingw. 8471 - fixup testcode/streamtcp to work on vista/mingw. 8472 - root-hints test checks version of dig required. 8473 - blacklisted servers are polled at a low rate (1%) to see if they 8474 come back up. But not if there is some other working server. 8475 847624 November 2008: Wouter 8477 - document that the user of the server daemon needs read privileges 8478 on the keys and certificates generated by unbound-control-setup. 8479 This is different per system or distribution, usually, running the 8480 script under the same username as the server uses suffices. 8481 i.e. sudo -u unbound unbound-control-setup 8482 - testset port to vista/mingw. 8483 - tcp_sigpipe to freebsd port. 8484 848521 November 2008: Wouter 8486 - fixed tcp accept, errors were printed when they should not. 8487 - unbound-control-setup.sh removes read/write permissions other 8488 from the keys it creates (as suggested by Dmitriy Demidov). 8489 849020 November 2008: Wouter 8491 - fixup fatal error due to faulty error checking after tcp accept. 8492 - add check in rlimit to avoid integer underflow. 8493 - rlimit check with new formula; better estimate for number interfaces 8494 - nicer comments in rlimit check. 8495 - tag 1.1.1 created in svn. 8496 - trunk label is 1.1.2 8497 849819 November 2008: Wouter 8499 - bug #219: fixed so that syslog which delays opening until the first 8500 log line is written, gets a log line while not chroot'ed yet. 8501 850218 November 2008: Wouter 8503 - iana portlist updated. 8504 - removed cast in unit test debug print that was not 64bit safe. 8505 - trunk back to 1.1.0; copied to tags 1.1.0 release. 8506 - trunk to has version number 1.1.1 again. 8507 - in 1.1.1; make clean nicer. grammar in manpage. 8508 850917 November 2008: Wouter 8510 - theoretical fix for problems reported on mailing list. 8511 If a delegation point has no A but only AAAA and do-ip6 is no, 8512 resolution would fail. Fixed to ask for the A and AAAA records. 8513 It has to ask for both always, so that it can fail quietly, from 8514 TLD perspective, when a zone is only reachable on one transport. 8515 - test for above, only AAAA and doip6 is no. Fix causes A record 8516 for nameserver to be fetched. 8517 - fixup address duplication on cache fillup for delegation points. 8518 - testset updated for new query answer requirements. 8519 852014 November 2008: Wouter 8521 - created 1.1.0 release tag in svn. 8522 - trunk moved to 1.1.1 8523 - fixup unittest-neg for locking. 8524 852513 November 2008: Wouter 8526 - added fedora init and specfile to contrib (by Paul Wouters). 8527 - added configure check for ldns 1.4.0 (using its compat funcs). 8528 - neater comments in worker.h. 8529 - removed doc/plan and updated doc/TODO. 8530 - silenced EHOSTDOWN (verbosity 2 or higher to see it). 8531 - review comments from Jelte, Matthijs. Neater code. 8532 853312 November 2008: Wouter 8534 - add unbound-control manpage to makedist replace list. 8535 853611 November 2008: Wouter 8537 - unit test for negative cache, stress tests the refcounting. 8538 - fix for refcounting error that could cause fptr_wlist fatal exit 8539 in the negative cache rbtree (upcoming 1.1 feature). (Thanks to 8540 Attila Nagy for testing). 8541 - nicer comments in cachedump about failed RR to string conversion. 8542 - fix 32bit wrap around when printing large (4G and more) mem usage 8543 for extended statistics. 8544 854510 November 2008: Wouter 8546 - fixup the getaddrinfo compat code rename. 8547 85488 November 2008: Wouter 8549 - added configure check for eee build warning. 8550 85517 November 2008: Wouter 8552 - fix bug 217: fixed, setreuid and setregid do not work on MacOSX10.4. 8553 - detect nonblocking problems in network stack in configure script. 8554 85556 November 2008: Wouter 8556 - dname_priv must decompress the name before comparison. 8557 - iana portlist updated. 8558 85595 November 2008: Wouter 8560 - fixed possible memory leak in key_entry_key deletion. 8561 Would leak a couple bytes when trust anchors were replaced. 8562 - if query and reply qname overlap, the bytes are skipped not copied. 8563 - fixed file descriptor leak when messages were jostled out that 8564 had outstanding (TCP) replies. 8565 - DNAMEs used from cache have their synthesized CNAMEs initialized 8566 properly. 8567 - fixed file descriptor leak for localzone type deny (for TCP). 8568 - fixed memleak at exit for nsec3 negative cached zones. 8569 - fixed memleak for the keyword 'nodefault' when reading config. 8570 - made verbosity of 'edns incapable peer' warning higher, so you 8571 do not get spammed by it. 8572 - caught elusive Bad file descriptor error bug, that would print the 8573 error while unnecessarily try to listen to a closed fd. Fixed. 8574 85754 November 2008: Wouter 8576 - fixed -Wwrite-strings warnings that result in better code. 8577 85783 November 2008: Wouter 8579 - fixup build process for Mac OSX linker, use ldns b32 compat funcs. 8580 - generated configure with autoconf-2.61. 8581 - iana portlist updated. 8582 - detect if libssl needs libdl. For static linking with libssl. 8583 - changed to use new algorithm identifiers for sha256/sha512 8584 from ldns 1.4.0 (need very latest version). 8585 - updated the included ldns tarball. 8586 - proper detection of SHA256 and SHA512 functions (not just sizes). 8587 858823 October 2008: Wouter 8589 - a little more debug info for failure on signer names. prints names. 8590 859122 October 2008: Wouter 8592 - CFLAGS are picked up by configure from the environment. 8593 - iana portlist updated. 8594 - updated ldns to use 1.4.0-pre20081022 so it picks up CFLAGS too. 8595 - new stub-prime: yesno option. Default is off, so it does not prime. 8596 can be turned on to get same behaviour as previous unbound release. 8597 - made automated test that checks if builtin root hints are uptodate. 8598 - finished draft-wijngaards-dnsext-resolver-side-mitigation 8599 implementation. The unwanted-reply-threshold can be set. 8600 - fixup so fptr_whitelist test in alloc.c works. 8601 860221 October 2008: Wouter 8603 - fix update-anchors.sh, so it does not report different RR order 8604 as an update. Sorts the keys in the file. Updated copyright. 8605 - fixup testbound on windows, the command control pipe doesn't exist. 8606 - skip 08hostlib test on windows, no fork() available. 8607 - made unbound-remote work on windows. 8608 860920 October 2008: Wouter 8610 - quench a log message that is debug only. 8611 - iana portlist updated. 8612 - do not query bogus nameservers. It is like nameservers that have 8613 the NS or A or AAAA record bogus are listed as donotquery. 8614 - if server selection is faced with only bad choices, it will 8615 attempt to get more options to be fetched. 8616 - changed bogus-ttl default value from 900 to 60 seconds. 8617 In anticipation that operator caused failures are more likely than 8618 actual attacks at this time. And thus repeated validation helps 8619 the operators get the problem fixed sooner. It makes validation 8620 failures go away sooner (60 seconds after the zone is fixed). 8621 Also it is likely to try different nameserver targets every minute, 8622 so that if a zone is bad on one server but not another, it is 8623 likely to pick up the 'correct' one after a couple minutes, 8624 and if the TTL is big enough that solves validation for the zone. 8625 - fixup unbound-control compilation on windows. 8626 862717 October 2008: Wouter 8628 - port Leopard/G5: fixup type conversion size_t/uint32. 8629 please ranlib, stop file without symbols warning. 8630 - harden referral path now also validates the root after priming. 8631 It looks up the root NS authoritatively as well as the root servers 8632 and attemps to validate the entries. 8633 863416 October 2008: Wouter 8635 - Fixup negative TTL values appearing (reported by Attila Nagy). 8636 863715 October 2008: Wouter 8638 - better documentation for 0x20; remove fallback TODO, it is done. 8639 - harden-referral-path feature includes A, AAAA queries for glue, 8640 as well as very careful NS caching (only when doing NS query). 8641 A, AAAA use the delegation from the NS-query. 8642 864314 October 2008: Wouter 8644 - fwd_three.tpkg test was flaky. If the three requests hit the 8645 wrong threads by chance (or bad OS) then the test would fail. 8646 Made less flaky by increasing number of retries. 8647 - stub_udp.tpkg changed to work, give root hints. fixed ldns_dname_abs. 8648 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081014). 8649 Which includes the ldns_dname_absolute fix. 8650 - fwd_three test remains flaky now that unbound does not stop 8651 listening when full. Thus, removed timeout problem. 8652 It may be serviced by three threads, or maybe by one. 8653 Mostly only useful for lock-check testing now. 8654 865513 October 2008: Wouter 8656 - fixed recursion servers deployed as authoritative detection, so 8657 that as a last resort, a +RD query is sent there to get the 8658 correct answer. 8659 - iana port list update. 8660 - ldns tarball is snapshot of ldns r2759 (1.4.0-pre-20081013). 8661 866210 October 2008: Wouter 8663 - fixup tests - the negative cache contained the correct NSEC3s for 8664 two tests that are supposed to fail to validate. 8665 86669 October 2008: Wouter 8667 - negative cache caps max iterations of NSEC3 done. 8668 - NSEC3 negative cache for qtype DS works. 8669 86708 October 2008: Wouter 8671 - NSEC negative cache for DS. 8672 86736 October 2008: Wouter 8674 - jostle-timeout option, so you can config for slow links. 8675 - 0x20 fallback code. Tries 3xnumber of nameserver addresses 8676 queries that must all be the same. Sent to random nameservers. 8677 - documented choices for DoS, EDNS, 0x20. 8678 86792 October 2008: Wouter 8680 - fixup unlink of pidfile. 8681 - fixup SHA256 algorithm collation code. 8682 - contrib/update-anchor.sh does not overwrite anchors if not needed. 8683 exits 0 when a restart is needed, other values if not. 8684 so, update-anchor.sh -d mydir && /etc/rc.d/unbound restart 8685 can restart unbound exactly when needed. 8686 868730 September 2008: Wouter 8688 - fixup SHA256 DS downgrade, no longer possible to downgrade to SHA1. 8689 - tests for sha256 support and downgrade resistance. 8690 - RSASHA256 and RSASHA512 support (using the draft in dnsext), 8691 using the drafted protocol numbers. 8692 - when using stub on localhost (127.0.0.1@10053) unbound works. 8693 Like when running NSD to host a local zone, on the same machine. 8694 The noprime feature. manpages more explanation. Added a test for it. 8695 - shorthand for reverse PTR, local-data-ptr: "1.2.3.4 www.ex.com" 8696 869729 September 2008: Wouter 8698 - EDNS lameness detection, if EDNS packets are dropped this is 8699 detected, eventually. 8700 - multiple query timeout rtt backoff does not backoff too much. 8701 870226 September 2008: Wouter 8703 - tests for remote-control. 8704 - small memory leak in exception during remote control fixed. 8705 - fixup for lock checking but not unchecking in remote control. 8706 - iana portlist updated. 8707 870823 September 2008: Wouter 8709 - Msg cache is loaded. A cache load enables cache responses. 8710 - unbound-control flush [name], flush_type and flush_zone. 8711 871222 September 2008: Wouter 8713 - dump_cache and load_cache statements in unbound-control. 8714 RRsets are dumped and loaded correctly. 8715 Msg cache is dumped. 8716 871719 September 2008: Wouter 8718 - locking on the localdata structure. 8719 - add and remove local zone and data with unbound-control. 8720 - ldns trunk snapshot updated, make tests work again. 8721 872218 September 2008: Wouter 8723 - fixup error in time calculation. 8724 - munin plugin improvements. 8725 - nicer abbreviations for high query types values (ixfr, axfr, any...) 8726 - documented the statistics output in unbound-control man page. 8727 - extended statistics prints out histogram, over unbound-control. 8728 872917 September 2008: Wouter 8730 - locking for threadsafe bogus rrset counter. 8731 - ldns trunk no longer exports b32 functions, provide compat. 8732 - ldns tarball updated. 8733 - testcode/ldns-testpkts.c const fixups. 8734 - fixed rcode stat printout. 8735 - munin plugin in contrib. 8736 - stats always printout uptime, because stats plugins need it. 8737 873816 September 2008: Wouter 8739 - extended-statistics: yesno config option. 8740 - unwanted replies spoof nearmiss detector. 8741 - iana portlist updated. 8742 874315 September 2008: Wouter 8744 - working start, stop, reload commands for unbound-control. 8745 - test for unbound-control working; better exit value for control. 8746 - verbosity control via unbound-control. 8747 - unbound-control stats. 8748 874912 September 2008: Wouter 8750 - removed browser control mentions. Proto speccy. 8751 875211 September 2008: Wouter 8753 - set nonblocking on new TCP streams, because linux does not inherit 8754 the socket options to the accepted socket. 8755 - fix TCP timeouts. 8756 - SSL protected connection between server and unbound-control. 8757 875810 September 2008: Wouter 8759 - remove memleak in privacy addresses on reloads and quits. 8760 - remote control work. 8761 87629 September 2008: Wouter 8763 - smallapp/unbound-control-setup.sh script to set up certificates. 8764 87654 September 2008: Wouter 8766 - scrubber scrubs away private addresses. 8767 - test for private addresses. man page entry. 8768 - code refactored for name and address tree lookups. 8769 87703 September 2008: Wouter 8771 - options for 'DNS Rebinding' protection: private-address and 8772 private-domain. 8773 - dnstree for reuse of routines that help with domain, addr lookups. 8774 - private-address and private-domain config option read, stored. 8775 87762 September 2008: Wouter 8777 - DoS protection features. Queries are jostled out to make room. 8778 - testbound can pass time, increasing the internal timer. 8779 - do not mark unsigned additionals bogus, leave unchecked, which 8780 is removed too. 8781 87821 September 2008: Wouter 8783 - disallow nonrecursive queries for cache snooping by default. 8784 You can allow is using access-control: <subnet> allow_snoop. 8785 The defaults do allow access no authoritative data without RD bit. 8786 - two tests for it and fixups of tests for nonrec refused. 8787 878829 August 2008: Wouter 8789 - version 1.1 number in trunk. 8790 - harden-referral-path option for query for NS records. 8791 Default turns off expensive, experimental option. 8792 879328 August 2008: Wouter 8794 - fixup logfile handling; it is created with correct permissions 8795 again. (from bugfix#199). 8796 Some errors are not written to logfile (pidfile writing, forking), 8797 and these are only visible by using the -d commandline flag. 8798 879927 August 2008: Wouter 8800 - daemon(3) is causing problems for people. Reverting the patch. 8801 bug#200, and 199 and 203 contain sideline discussion on it. 8802 - bug#199 fixed: pidfile can be outside chroot. openlog is done before 8803 chroot and drop permissions. 8804 - config option to set size of aggressive negative cache, 8805 neg-cache-size. 8806 - bug#203 fixed: dlv has been implemented. 8807 880826 August 2008: Wouter 8809 - test for insecure zone when DLV is in use, also does negative cache. 8810 - test for trustanchor when DLV is in use (the anchor works). 8811 - test for DLV used for a zone below a trustanchor. 8812 - added scrub filter for overreaching NSEC records and unit test. 8813 - iana portlist update 8814 - use of setresuid or setreuid when available. 8815 - use daemon(3) if available. 8816 881725 August 2008: Wouter 8818 - realclean patch from Robert Edmonds. 8819 882022 August 2008: Wouter 8821 - nicer debuglogging of DLV. 8822 - test with secure delegation inside the DLV repository. 8823 882421 August 2008: Wouter 8825 - negative cache code linked into validator, for DLV use. 8826 negative cache works for DLV. 8827 - iana portlist update. 8828 - dlv-anchor option for unit tests. 8829 - fixup NSEC_AT_APEX classification for short typemaps. 8830 - ldns-testns has subdomain checks, for unit tests. 8831 883220 August 2008: Wouter 8833 - negative cache code, reviewed. 8834 883518 August 2008: Wouter 8836 - changes info: in logfile to notice: info: or debug: depending on 8837 the verbosity of the statements. Better logfile message 8838 classification. 8839 - bug #208: extra rc.d unbound flexibility for freebsd/nanobsd. 8840 884115 August 2008: Wouter 8842 - DLV nsec code fixed for better detection of closest existing 8843 enclosers from NSEC responses. 8844 - DLV works, straight to the dlv repository, so not for production. 8845 - Iana port update. 8846 884714 August 2008: Wouter 8848 - synthesize DLV messages from the rrset cache, like done for DS. 8849 885013 August 2008: Wouter 8851 - bug #203: nicer do-auto log message when user sets incompatible 8852 options. 8853 - bug #204: variable name ameliorated in log.c. 8854 - bug #206: in iana_update, no egrep, but awk use. 8855 - ldns snapshot r2699 taken (includes DLV type). 8856 - DLV work, config file element, trust anchor read in. 8857 885812 August 2008: Wouter 8859 - finished adjusting testset to provide qtype NS answers. 8860 886111 August 2008: Wouter 8862 - Fixup rrset security updates overwriting 2181 trust status. 8863 This makes validated to be insecure data just as worthless as 8864 nonvalidated data, and 2181 rules prevent cache overwrites to them. 8865 - Fix assertion fail on bogus key handling. 8866 - dnssec lameness detection works on first query at trust apex. 8867 - NS queries get proper cache and dnssec lameness treatment. 8868 - fixup compilation without pthreads on linux. 8869 88708 August 2008: Wouter 8871 - NS queries are done after every referral. 8872 validator is used on those NS records (if anchors enabled). 8873 88747 August 2008: Wouter 8875 - Scrubber more strict. CNAME chains, DNAMEs from cache, other 8876 irrelevant rrsets removed. 8877 - 1.0.2 released from 1.0 support branch. 8878 - fixup update-anchor.sh to work both in BSD shell and bash. 8879 88805 August 2008: Wouter 8881 - fixup DS test so apex nodata works again. 8882 88834 August 2008: Wouter 8884 - iana port update. 8885 - TODO update. 8886 - fix bug 201: null ptr deref on cleanup while udp pkts wait for port. 8887 - added explanatory text for outgoing-port-permit in manpage. 8888 888930 July 2008: Wouter 8890 - fixup bug qtype DS for unsigned zone and signed parent validation. 8891 889225 July 2008: Wouter 8893 - added original copyright statement of OpenBSD arc4random code. 8894 - created tube signaling solution on windows, as a pipe replacement. 8895 this makes background asynchronous resolution work on windows. 8896 - removed very insecure socketpair compat code. It also did not 8897 work with event_waiting. Solved by pipe replacement. 8898 - unbound -h prints openssl version number as well. 8899 890022 July 2008: Wouter 8901 - moved pipe actions to util/tube.c. easier porting and shared code. 8902 - check _raw() commpoint callbacks with fptr_wlist. 8903 - iana port update. 8904 890521 July 2008: Wouter 8906 - #198: nicer entropy warning message. manpage OS hints. 8907 890819 July 2008: Wouter 8909 - #198: fixup man page to suggest chroot entropy fix. 8910 891118 July 2008: Wouter 8912 - branch for 1.0 support. 8913 - trunk work on tube.c. 8914 891517 July 2008: Wouter 8916 - fix bug #196, compile outside source tree. 8917 - fix bug #195, add --with-username=user configure option. 8918 - print error and exit if started with config that requires more 8919 fds than the builtin minievent can handle. 8920 892116 July 2008: Wouter 8922 - made svn tag 1.0.1, trunk now 1.0.2 8923 - sha256 checksums enabled in makedist.sh 8924 892515 July 2008: Wouter 8926 - Follow draft-ietf-dnsop-default-local-zones-06 added reverse 8927 IPv6 example prefix to AS112 default blocklist. 8928 - fixup lookup of DS records by client with trustanchor for same. 8929 - libunbound ub_resolve, fix handling of error condition during setup. 8930 - lowered log_hex blocksize to fit through BSD syslog linesize. 8931 - no useless initialisation if getpwnam not available. 8932 - iana, ldns snapshot updated. 8933 89343 July 2008: Wouter 8935 - Matthijs fixed memory leaks in root hints file reading. 8936 893726 June 2008: Wouter 8938 - fixup streamtcp bounds setting for udp mode, in the test framework. 8939 - contrib item for updating trust anchors. 8940 894125 June 2008: Wouter 8942 - fixup fwd_ancil test typos. 8943 - Fix for newegg lameness : ok for qtype=A, but lame for others. 8944 - fixup unit test for infra cache, test lame merging. 8945 - porting to mingw, bind, listen, getsockopt and setsockopt error 8946 handling. 8947 894824 June 2008: Wouter 8949 - removed testcode/checklocks from production code compilation path. 8950 - streamtcp can use UDP mode (connected UDP socket), for testing IPv6 8951 on windows. 8952 - fwd_ancil test fails if platform support is lacking. 8953 895423 June 2008: Wouter 8955 - fixup minitpkg to cleanup on windows with its file locking troubles. 8956 - minitpkg shows skipped tests in report. 8957 - skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not 8958 ipv6 connectivity). 8959 - winsock event handler keeps track of sticky TCP events, that have 8960 not been fully handled yet. when interest in the event(s) resumes, 8961 they are sent again. When WOULDBLOCK is returned events are cleared. 8962 - skip tests that need signals when testing on mingw. 8963 896418 June 2008: Wouter 8965 - open testbound replay files in binary mode, because fseek/ftell 8966 do not work in ascii-mode on windows. The b does nothing on unix. 8967 unittest and testbound tests work on windows (xp too). 8968 - ioctlsocket prints nicer error message. 8969 - fixed up some TCP porting for winsock. 8970 - lack of IPv6 gives a warning, no fatal error. 8971 - use WSAGetLastError() on windows instead of errno for some errors. 8972 897317 June 2008: Wouter 8974 - outgoing num fds 32 by default on windows ; it supports less 8975 fds for waiting on than unixes. 8976 - winsock_event minievent handler for windows. (you could also 8977 attempt to link with libevent/libev ports for windows). 8978 - neater crypto check and gdi32 detection. 8979 - unbound.exe works to resolve and validate www.nlnetlabs.nl on vista. 8980 898116 June 2008: Wouter 8982 - on windows, use windows threads, mutex and thread-local-storage(Tls). 8983 - detect if openssl needs gdi32. 8984 - if no threading, THREADS_DISABLED is defined for use in the code. 8985 - sets USE_WINSOCK if using ws2_32 on windows. 8986 - wsa_strerror() function for more readable errors. 8987 - WSA Startup and Cleanup called in unbound.exe. 8988 898913 June 2008: Wouter 8990 - port mingw32, more signal ifdefs, detect sleep, usleep, 8991 random, srandom (used inside the tests). 8992 - signed or unsigned FD_SET is cast. 8993 899410 June 2008: Wouter 8995 - fixup warnings compiling on eeepc xandros linux. 8996 89979 June 2008: Wouter 8998 - in iteration response type code 8999 * first check for SOA record (negative answer) before NS record 9000 and lameness. 9001 * check if no AA bit for non-forwarder, and thus lame zone. 9002 In response to error report by Richard Doty for mail.opusnet.com. 9003 - fixup unput warning from lexer on freeBSD. 9004 - bug#183. pidfile, rundir, and chroot configure options. Also the 9005 example.conf and manual pages get the configured defaults. 9006 You can use: (or accept the defaults to /usr/local/etc/unbound/) 9007 --with-conf-file=filename 9008 --with-pidfile=filename 9009 --with-run-dir=path 9010 --with-chroot-dir=path 9011 90128 June 2008: Wouter 9013 - if multiple CNAMEs, use the first one. Fixup akamai CNAME bug. 9014 Reported by Robert Edmonds. 9015 - iana port updated. 9016 90174 June 2008: Wouter 9018 - updated libtool files with newer version. 9019 - iana portlist updated. 9020 90213 June 2008: Wouter 9022 - fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the 9023 trailing dot is not used during comparison. 9024 90252 June 2008: Wouter 9026 - Jelte fixed bugs in my absence 9027 - bug 178: fixed unportable shell usage in configure (relied on 9028 bash shell). 9029 - bug 180: fixed buffer overflow in unbound-checkconf use of strncat. 9030 - bug 181: fixed buffer overflow in ldns (called by unbound to parse 9031 config file parts). 9032 - fixes by Wouter 9033 - bug 177: fixed compilation failure on opensuse, the 9034 --disable-static configure flag caused problems. (Patch from 9035 Klaus Singvogel) 9036 - bug 179: same fix as 177. 9037 - bug 185: --disable-shared not passed along to ldns included with 9038 unbound. Fixed so that configure parameters are passed to the 9039 subdir configure script. 9040 fixed that ./libtool is used always, you can still override 9041 manually with ./configure libtool=mylibtool or set $libtool in 9042 the environment. 9043 - update of the ldns tarball to current ldns svn version (fix 181). 9044 - bug 184: -r option for unbound-host, read resolv.conf for 9045 forwarder. (Note that forwarder must support DNSSEC for validation 9046 to succeed). 9047 904823 May 2008: Wouter 9049 - mingw32 porting. 9050 - test for sys/wait.h 9051 - WSAEWOULDBLOCK test after nonblocking TCP connect. 9052 - write_iov_buffer removed: unused and no struct iov on windows. 9053 - signed/unsigned warning fixup mini_event. 9054 - use ioctlsocket to set nonblocking I/O if fnctl is unavailable. 9055 - skip signals that are not defined 9056 - detect pwd.h. 9057 - detect getpwnam, getrlimit, setsid, sbrk, chroot. 9058 - default config has no chroot if chroot() unavailable. 9059 - if no kill() then no pidfile is read or written. 9060 - gmtime_r is replaced by nonthreadsafe alternative if unavail. 9061 used in rrsig time validation errors. 9062 906322 May 2008: Wouter 9064 - contrib unbound.spec from Patrick Vande Walle. 9065 - fixup bug#175: call tzset before chroot to have correct timestamps 9066 in system log. 9067 - do not generate lex input and lex unput functions. 9068 - mingw port. replacement functions labelled _unbound. 9069 - fix bug 174 - check for tcp_sigpipe that ldns-testns is installed. 9070 907119 May 2008: Wouter 9072 - fedora 9, check in6_pktinfo define in configure. 9073 - CREDITS fixup of history. 9074 - ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative. 9075 907616 May 2008: Wouter 9077 - fixup for MacOSX hosts file reading (reported by John Dickinson). 9078 - created 1.0.0 svn tag. 9079 - trunk version 1.0.1. 9080 908114 May 2008: Wouter 9082 - accepted patch from Ondrej Sury for library version libtool option. 9083 - configure --disable-rpath fixes up libtool for rpath trouble. 9084 Adapted from debian package patch file. 9085 908613 May 2008: Wouter 9087 - Added root ipv6 addresses to builtin root hints. 9088 - TODO modified for post 1.0 plans. 9089 - trunk version set to 1.0.0. 9090 - no unnecessary linking with librt (only when libevent/libev used). 9091 90927 May 2008: Wouter 9093 - fixup no-ip4 problem with error callback in outside network. 9094 909525 April 2008: Wouter 9096 - DESTDIR is honored by the Makefile for rpms. 9097 - contrib files unbound.spec and unbound.init, builds working RPM 9098 on FC7 Linux, a chrooted caching resolver, and libunbound. 9099 - iana ports update. 9100 910124 April 2008: Wouter 9102 - chroot checks improved. working directory relative to chroot. 9103 checks if config file path is inside chroot. Documentation on it. 9104 - nicer example.conf text. 9105 - created 0.11 tag. 9106 910723 April 2008: Wouter 9108 - parseunbound.pl contrib update from Kai Storbeck for threads. 9109 - iana ports update 9110 911122 April 2008: Wouter 9112 - ignore SIGPIPE. 9113 - unit test for SIGPIPE ignore. 9114 911521 April 2008: Wouter 9116 - FEATURES document. 9117 - fixup reread of config file if it was given as a full path 9118 and chroot was used. 9119 912016 April 2008: Wouter 9121 - requirements doc, updated clean query returns. 9122 - parseunbound.pl update from Kai Storbeck. 9123 - sunos4 porting changes. 9124 912515 April 2008: Wouter 9126 - fixup default rc.d pidfile location to /usr/local/etc. 9127 - iana ports updated. 9128 - copyright updated in ldns-testpkts to keep same as in ldns. 9129 - fixup checkconf chroot tests a bit more, chdir must be inside 9130 chroot dir. 9131 - documented 'gcc: unrecognized -KPIC option' errors on Solaris. 9132 - example.conf values changed to /usr/local/etc/unbound 9133 - DSA test work. 9134 - DSA signatures: unbound is compatible with both encodings found. 9135 It will detect and convert when necessary. 9136 913714 April 2008: Wouter 9138 - got update for parseunbound.pl statistics script from Kai Storbeck. 9139 - tpkg tests for udp wait list. 9140 - documented 0x20 status. 9141 - fixup chroot and checkconf, it is much smarter now. 9142 - fixup DSA EVP signature decoding. Solution that Jelte found copied. 9143 - and check first sig byte for the encoding type. 9144 914511 April 2008: Wouter 9146 - random port selection out of the configged ports. 9147 - fixup threadsafety for libevent-1.4.3+ (event_base_get_method). 9148 - removed base_port. 9149 - created 256-port ephemeral space for the OS, 59802 available. 9150 - fixup consistency of port_if out array during heavy use. 9151 915210 April 2008: Wouter 9153 - --with-libevent works with latest libevent 1.4.99-trunk. 9154 - added log file statistics perl script to contrib. 9155 - automatic iana ports update from makefile. 60058 available. 9156 91579 April 2008: Wouter 9158 - configure can detect libev(from its build directory) when passed 9159 --with-libevent=/home/wouter/libev-3.2 9160 libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%). 9161 - unused commpoints not listed in epoll list. 9162 - statistics-cumulative option so that the values are not reset. 9163 - config creates array of available ports, 61841 available, 9164 it excludes <1024 and iana assigned numbers. 9165 config statements to modify the available port numbers. 9166 91678 April 2008: Wouter 9168 - unbound tries to set the ulimit fds when started as server. 9169 if that does not work, it will scale back its requirements. 9170 917127 March 2008: Wouter 9172 - documented /dev/random symlink from chrootdir as FAQ entry. 9173 917426 March 2008: Wouter 9175 - implemented AD bit signaling. If a query sets AD bit (but not DO) 9176 then the AD bit is set in the reply if the answer validated. 9177 Without including DNSSEC signatures. Useful if you have a trusted 9178 path from the client to the resolver. Follows dnssec-updates draft. 9179 918025 March 2008: Wouter 9181 - implemented check that for NXDOMAIN and NOERROR answers a query 9182 section must be present in the reply (by the scrubber). And it must 9183 be equal to the question sent, at least lowercase folded. 9184 Previously this feature happened because the cache code refused 9185 to store such messages. However blocking by the scrubber makes 9186 sure nothing gets into the RRset cache. Also, this looks like a 9187 timeout (instead of an allocation failure) and this retries are 9188 done (which is useful in a spoofing situation). 9189 - RTT banding. Band size 400 msec, this makes band around zero (fast) 9190 include unknown servers. This makes unbound explore unknown servers. 9191 91927 March 2008: Wouter 9193 - -C config feature for harvest program. 9194 - harvest handles CNAMEs too. 9195 91965 March 2008: Wouter 9197 - patch from Hugo Koji Kobayashi for iterator logs spelling. 9198 91994 March 2008: Wouter 9200 - From report by Jinmei Tatuya, rfc2181 trust value for remainder 9201 of a cname trust chain is lower; not full answer_AA. 9202 - test for this fix. 9203 - default config file location is /usr/local/etc/unbound. 9204 Thus prefix is used to determine the location. This is also the 9205 chroot and pidfile default location. 9206 92073 March 2008: Wouter 9208 - Create 0.10 svn tag. 9209 - 0.11 version in trunk. 9210 - indentation nicer. 9211 921229 February 2008: Wouter 9213 - documentation update. 9214 - fixup port to Solaris of perf test tool. 9215 - updated ldns-tarball with decl-after-statement fixes. 9216 921728 February 2008: Wouter 9218 - fixed memory leaks in libunbound (during cancellation and wait). 9219 - libunbound returns the answer packet in full. 9220 - snprintf compat update. 9221 - harvest performs lookup. 9222 - ldns-tarball update with fix for ldns_dname_label. 9223 - installs to sbin by default. 9224 - install all manual pages (unbound-host and libunbound too). 9225 922627 February 2008: Wouter 9227 - option to use caps for id randomness. 9228 - config file option use-caps-for-id: yes 9229 - harvest debug tool 9230 923126 February 2008: Wouter 9232 - delay utility delays TCP as well. If the server that is forwarded 9233 to has a TCP error, the delay utility closes the connection. 9234 - delay does REUSE_ADDR, and can handle a server that closes its end. 9235 - answers use casing from query. 9236 923725 February 2008: Wouter 9238 - delay utility works. Gets decent thoughput too (>20000). 9239 924022 February 2008: Wouter 9241 - +2% for recursions, if identical queries (except for destination 9242 and query ID) in the reply list, avoid re-encoding the answer. 9243 - removed TODO items for optimizations that do not show up in 9244 profile reports. 9245 - default is now minievent - not libevent. As its faster and 9246 not needed for regular installs, only for very large port ranges. 9247 - loop check different speedup pkt-dname-reading, 1% faster for 9248 nocache-recursion check. 9249 - less hashing during msg parse, 4% for recursion. 9250 - small speed fix for dname_count_size_labels, +1 or +2% recursion. 9251 - some speed results noted: 9252 optimization resulted in +40% for recursion (cache miss) and 9253 +70 to +80 for cache hits, and +96% for version.bind. 9254 zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4 9255 www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3 9256 www with DO bit set : BIND 8269.31 Ub 28735.6 qps. 9257 So, unbound can be about equal qps to NSD in cache hits. 9258 And about 3.4x faster than BIND in cache performance. 9259 - delay utility for testing. 9260 926121 February 2008: Wouter 9262 - speedup of root-delegation message encoding by 15%. 9263 - minor speedup of compress tree_lookup, maybe 1%. 9264 - speedup of dname_lab_cmp and memlowercmp - the top functions in 9265 profiler output, maybe a couple percent when it matters. 9266 926720 February 2008: Wouter 9268 - setup speec_cache for need-ldns-testns in dotests. 9269 - check number of queued replies on incoming queries to avoid overload 9270 on that account. 9271 - fptr whitelist checks are not disabled in optimize mode. 9272 - do-daemonize config file option. 9273 - minievent time share initializes time at start. 9274 - updated testdata for nsec3 new algorithm numbers (6, 7). 9275 - small performance test of packet encoding (root delegation). 9276 927719 February 2008: Wouter 9278 - applied patch to unbound-host man page from Jan-Piet Mens. 9279 - fix donotquery-localhost: yes default (it erroneously was switched 9280 to default 'no'). 9281 - time is only gotten once and the value is shared across unbound. 9282 - unittest cleans up crypto, so that it has no memory leaks. 9283 - mini_event shares the time value with unbound this results in 9284 +3% speed for cache responses and +9% for recursions. 9285 - ldns tarball update with new NSEC3 sign code numbers. 9286 - perform several reads per UDP operation. This improves performance 9287 in DoS conditions, and costs very little in normal conditions. 9288 improves cache response +50%, and recursions +10%. 9289 - modified asynclook test. because the callback from async is not 9290 in any sort of lock (and thus can use all library functions freely), 9291 this causes a tiny race condition window when the last lock is 9292 released for a callback and a new cancel() for that callback. 9293 The only way to remove this is by putting callbacks into some 9294 lock window. I'd rather have the small possibility of a callback 9295 for a cancelled function then no use of library functions in 9296 callbacks. Could be possible to only outlaw process(), wait(), 9297 cancel() from callbacks, by adding another lock, but I'd rather not. 9298 929918 February 2008: Wouter 9300 - patch to unbound-host from Jan-Piet Mens. 9301 - unbound host prints errors if fails to configure context. 9302 - fixup perf to resend faster, so that long waiting requests do 9303 not hold up the queue, they become lost packets or SERVFAILs, 9304 or can be sent a little while later (i.e. processing time may 9305 take long, but throughput has to be high). 9306 - fixup iterator operating in no cache conditions (RD flag unset 9307 after a CNAME). 9308 - streamlined code for RD flag setting. 9309 - profiled code and changed dname compares to be faster. 9310 The speedup is about +3% to +8% (depending on the test). 9311 - minievent tests for eintr and eagain. 9312 931315 February 2008: Wouter 9314 - added FreeBSD rc.d script to contrib. 9315 - --prefix option for configure also changes directory: pidfile: 9316 and chroot: defaults in config file. 9317 - added cache speed test, for cache size OK and cache too small. 9318 931914 February 2008: Wouter 9320 - start without a config file (will complain, but start with 9321 defaults). 9322 - perf test program works. 9323 932413 February 2008: Wouter 9325 - 0.9 released. 9326 - 1.0 development. Printout ldns version on unbound -h. 9327 - start of perf tool. 9328 - bugfix to read empty lines from /etc/hosts. 9329 933012 February 2008: Wouter 9331 - fixup problem with configure calling itself if ldns-src tarball 9332 is not present. 9333 933411 February 2008: Wouter 9335 - changed library to use ub_ instead of ub_val_ as prefix. 9336 - statistics output text nice. 9337 - etc/hosts handling. 9338 - library function to put logging to a stream. 9339 - set any option interface. 9340 93418 February 2008: Wouter 9342 - test program for multiple queries over a TCP channel. 9343 - tpkg test for stream tcp queries. 9344 - unbound replies to multiple TCP queries on a TCP channel. 9345 - fixup misclassification of root referral with NS in answer 9346 when validating a nonrec query. 9347 - tag 0.9 9348 - layout of manpages, spelling fix in header, manpages process by 9349 makedist, list asynclook and tcpstream tests as ldns-testns 9350 required. 9351 93527 February 2008: Wouter 9353 - moved up all current level 2 to be level 3. And 3 to 4. 9354 to make room for new debug level 2 for detailed information 9355 for operators. 9356 - verbosity level 2. Describes recursion and validation. 9357 - cleaner configure script and fixes for libevent solaris. 9358 - signedness for log output memory sizes in high verbosity. 9359 93606 February 2008: Wouter 9361 - clearer explanation of threading configure options. 9362 - fixup asynclook test for nothreading (it creates only one process 9363 to do the extended test). 9364 - changed name of ub_val_result_free to ub_val_resolve_free. 9365 - removes warning message during library linking, renamed 9366 libunbound/unbound.c -> libunbound.c and worker to libworker. 9367 - fallback without EDNS if result is NOTIMPL as well as on FORMERR. 9368 93695 February 2008: Wouter 9370 - statistics-interval: seconds option added. 9371 - test for statistics option 9372 - ignore errors making directories, these can occur in parallel builds 9373 - fixup Makefile strip command and libunbound docs typo. 9374 937531 January 2008: Wouter 9376 - bg thread/process reads and writes the pipe nonblocking all the time 9377 so that even if the pipe is buffered or so, the bg thread does not 9378 block, and services both pipes and queries. 9379 938030 January 2008: Wouter 9381 - check trailing / on chrootdir in checkconf. 9382 - check if root hints and anchor files are in chrootdir. 9383 - no route to host tcp error is verbosity level 2. 9384 - removed unused send_reply_iov. and its configure check. 9385 - added prints of 'remote address is 1.2.3.4 port 53' to errors 9386 from netevent; the basic socket errors. 9387 938828 January 2008: Wouter 9389 - fixup uninit use of buffer by libunbound (query id, flags) for 9390 local_zone answers. 9391 - fixup uninit warning from random.c; also seems to fix sporadic 9392 sigFPE coming out of openssl. 9393 - made openssl entropy warning more silent for library use. Needs 9394 verbosity 1 now. 9395 - fixup forgotten locks for rbtree_searches on ctx->query tree. 9396 - random generator cleanup - RND_STATE_SIZE removed, and instead 9397 a super-rnd can be passed at init to chain init random states. 9398 - test also does lock checks if available. 9399 - protect config access in libworker_setup(). 9400 - libevent doesn't like comm_base_exit outside of runloop. 9401 - close fds after removing commpoints only (for epoll, kqueue). 9402 940325 January 2008: Wouter 9404 - added tpkg for asynclook and library use. 9405 - allows localhost to be queried when as a library. 9406 - fixup race condition between cancel and answer (in case of 9407 really fast answers that beat the cancel). 9408 - please doxygen, put doxygen comment in one place. 9409 - asynclook -b blocking mode and test. 9410 - refactor asynclook, nicer code. 9411 - fixup race problems from opensll in rand init from library, with 9412 a mutex around the rand init. 9413 - fix pass async_id=NULL to _async resolve(). 9414 - rewrote _wait() routine, so that it is threadsafe. 9415 - cancelation is threadsafe. 9416 - asynclook extended test in tpkg. 9417 - fixed two races where forked bg process waits for (somehow shared?) 9418 locks, so does not service the query pipe on the bg side. 9419 Now those locks are only held for fg_threads and for bg_as_a_thread. 9420 942124 January 2008: Wouter 9422 - tested the cancel() function. 9423 - asynclook -c (cancel) feature. 9424 - fix fail to allocate context actions. 9425 - make pipe nonblocking at start. 9426 - update plane for retry mode with caution to limit bandwidth. 9427 - fix Makefile for concurrent make of unbound-host. 9428 - renamed ub_val_ctx_wait/poll/process/fd to ub_val*. 9429 - new calls to set forwarding added to header and docs. 9430 943123 January 2008: Wouter 9432 - removed debug prints from if-auto, verb-algo enables some. 9433 - libunbound QUIT setup, remove memory leaks, when using threads 9434 will share memory for passing results instead of writing it over 9435 the pipe, only writes ID number over the pipe (towards the handler 9436 thread that does process() ). 9437 943822 January 2008: Wouter 9439 - library code for async in libunbound/unbound.c. 9440 - fix link testbound. 9441 - fixup exit bug in mini_event. 9442 - background worker query enter and result functions. 9443 - bg query test application asynclook, it looks up multiple 9444 hostaddresses (A records) at the same time. 9445 944621 January 2008: Wouter 9447 - libworker work, netevent raw commpoints, write_msg, serialize. 9448 944918 January 2008: Wouter 9450 - touch up of manpage for libunbound. 9451 - support for IP_RECVDSTADDR (for *BSD ip4). 9452 - fix for BSD, do not use ip4to6 mapping, make two sockets, once 9453 ip6 and once ip4, uses socket options. 9454 - goodbye ip4to6 mapping. 9455 - update ldns-testpkts with latest version from ldns-trunk. 9456 - updated makedist for relative ldns pathnames. 9457 - library API with more information inside the result structure. 9458 - work on background resolves. 9459 946017 January 2008: Wouter 9461 - fixup configure in case -lldns is installed. 9462 - fixup a couple of doxygen warnings, about enum variables. 9463 - interface-automatic now copies the interface address from the 9464 PKT_INFO structure as well. 9465 - manual page with library API, all on one page 'man libunbound'. 9466 - rewrite of PKTINFO structure, it also captures IP4 PKTINFO. 9467 946816 January 2008: Wouter 9469 - incoming queries to the server with TC bit on are replied FORMERR. 9470 - interface-automatic replied the wrong source address on localhost 9471 queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying 9472 to use ifnum=-1 to mean 'no interface, use kernel route'. 9473 947415 January 2008: Wouter 9475 - interface-automatic feature. experimental. Nice for anycast. 9476 - tpkg test for ip6 ancillary data. 9477 - removed debug prints. 9478 - porting experience, define for Solaris, test refined for BSD 9479 compatibility. The feature probably will not work on OpenBSD. 9480 - makedist fixup for ldns-src in build-dir. 9481 948214 January 2008: Wouter 9483 - in no debug sets NDEBUG to remove asserts. 9484 - configure --enable-debug is needed for dependency generation 9485 for assertions and for compiler warnings. 9486 - ldns.tgz updated with ldns-trunk (where buffer.h is updated). 9487 - fix lint, unit test in optimize mode. 9488 - default access control allows ::ffff:127.0.0.1 v6mapped localhost. 9489 949011 January 2008: Wouter 9491 - man page, warning removed. 9492 - added text describing the use of stub zones for private zones. 9493 - checkconf tests for bad hostnames (IP address), and for doubled 9494 interface lines. 9495 - memory sizes can be given with 'k', 'Kb', or M or G appended. 9496 949710 January 2008: Wouter 9498 - typo in example.conf. 9499 - made using ldns-src that is included the package more portable 9500 by linking with .lo instead of .o files in the ldns package. 9501 - nicer do-ip6: yes/no documentation. 9502 - nicer linking of libevent .o files. 9503 - man pages render correctly on solaris. 9504 95059 January 2008: Wouter 9506 - fixup openssl RAND problem, when the system is not configured to 9507 give entropy, and the rng needs to be seeded. 9508 95098 January 2008: Wouter 9510 - print median and quartiles with extensive logging. 9511 95124 January 2008: Wouter 9513 - document misconfiguration in private network. 9514 95152 January 2008: Wouter 9516 - fixup typo in requirements. 9517 - document that 'refused' is a better choice than 'drop' for 9518 the access control list, as refused will stop retries. 9519 95207 December 2007: Wouter 9521 - unbound-host has a -d option to show what happens. This can help 9522 with debugging (why do I get this answer). 9523 - fixup CNAME handling, on nodata, sets and display canonname. 9524 - dot removed from CNAME display. 9525 - respect -v for NXDOMAINs. 9526 - updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes). 9527 - size_t to int for portability of the header file. 9528 - fixup bogus handling. 9529 - dependencies and lint for unbound-host. 9530 95316 December 2007: Wouter 9532 - library resolution works in foreground mode, unbound-host app 9533 receives data. 9534 - unbound-host prints rdata using ldns. 9535 - unbound-host accepts trust anchors, and prints validation 9536 information when you give -v. 9537 95385 December 2007: Wouter 9539 - locking in context_new() inside the function. 9540 - setup of libworker. 9541 95424 December 2007: Wouter 9543 - minor Makefile fixup. 9544 - moved module-stack code out of daemon/daemon into services/modstack, 9545 preparing for code-reuse. 9546 - move context into own header file. 9547 - context query structure. 9548 - removed unused variable pwd from checkconf. 9549 - removed unused assignment from outside netw. 9550 - check timeval length of string. 9551 - fixup error in val_utils getsigner. 9552 - fixup same (*var) error in netblocktostr. 9553 - fixup memleak on parse error in localzone. 9554 - fixup memleak on packet parse error. 9555 - put ; after union in parser.y. 9556 - small hardening in iter_operate against iq==NULL. 9557 - hardening, if error reply with rcode=0 (noerror) send servfail. 9558 - fixup same (*var) error in find_rrset in msgparse, was harmless. 9559 - check return value of evtimer_add(). 9560 - fixup lockorder in lruhash_reclaim(), building up a list of locked 9561 entries one at a time. Instead they are removed and unlocked. 9562 - fptr_wlist for markdelfunc. 9563 - removed is_locked param from lruhash delkeyfunc. 9564 - moved bin_unlock during bin_split purely to please. 9565 95663 December 2007: Wouter 9567 - changed checkconf/ to smallapp/ to make room for more support tools. 9568 (such as unbound-host). 9569 - install dirs created with -m 755 because they need to be accessible. 9570 - library extensive featurelist added to TODO. 9571 - please doxygen, lint. 9572 - library test application, with basic functionality. 9573 - fix for building in a subdirectory. 9574 - link lib fix for Leopard. 9575 957630 November 2007: Wouter 9577 - makefile that creates libunbound.la, basic file or libunbound.a 9578 when creating static executables (no libtool). 9579 - more API setup. 9580 958129 November 2007: Wouter 9582 - 0.9 public API start. 9583 958428 November 2007: Wouter 9585 - Changeup plan for 0.8 - no complication needed, a simple solution 9586 has been chosen for authoritative features. 9587 - you can use single quotes in the config file, so it is possible 9588 to specify TXT records in local data. 9589 - fixup small memory problem in implicit transparent zone creation. 9590 - test for implicit zone creation and multiple RR RRsets local data. 9591 - local-zone nodefault test. 9592 - show testbound testlist on commit. 9593 - iterator normalizer changes CNAME chains ending in NXDOMAIN where 9594 the packet got rcode NXDOMAIN into rcode NOERROR. (since the initial 9595 domain exists). 9596 - nicer verbosity: 0 and 1 levels. 9597 - lower nonRDquery chance of eliciting wrongly typed validation 9598 requiring message from the cache. 9599 - fix for nonRDquery validation typing; nodata is detected when 9600 SOA record in auth section (all validation-requiring nodata messages 9601 have a SOA record in authority, so this is OK for the validator), 9602 and NS record is needed to be a referral. 9603 - duplicate checking when adding NSECs for a CNAME, and test. 9604 - created svn tag 0.8, after completing testbed tests. 9605 960627 November 2007: Wouter 9607 - per suggestion in rfc2308, replaced default max-ttl value with 1 day. 9608 - set size of msgparse lookup table to 32, from 1024, so that its size 9609 is below the 2048 regional large size threshold, and does not cause 9610 a call to malloc when a message is parsed. 9611 - update of memstats tool to print number of allocation calls. 9612 This is what is taking time (not space) and indicates the avg size 9613 of the allocations as well. region_alloc stat is removed. 9614 961522 November 2007: Wouter 9616 - noted EDNS in-the-middle dropping trouble as a TODO. 9617 At this point theoretical, no user trouble has been reported. 9618 - added all default AS112 zones. 9619 - answers from local zone content. 9620 * positive answer, the rrset in question 9621 * nodata answer (exist, but not that type). 9622 * nxdomain answer (domain does not exist). 9623 * empty-nonterminal answer. 9624 * But not: wildcard, nsec, referral, rrsig, cname/dname, 9625 or additional section processing, NS put in auth. 9626 - test for correct working of static and transparent and couple 9627 of important defaults (localhost, as112, reverses). 9628 Also checks deny and refuse settings. 9629 - fixup implicit zone generation and AA bit for NXDOMAIN on localdata. 9630 963121 November 2007: Wouter 9632 - local zone internal data setup. 9633 963420 November 2007: Wouter 9635 - 0.8 - str2list config support for double string config options. 9636 - local-zone and local-data options, config storage and documentation. 9637 963819 November 2007: Wouter 9639 - do not downcase NSEC and RRSIG for verification. Follows 9640 draft-ietf-dnsext-dnssec-bis-updates-06.txt. 9641 - fixup leaking unbound daemons at end of tests. 9642 - README file updated. 9643 - nice libevent not found error. 9644 - README talks about gnu make. 9645 - 0.8: unit test for addr_mask and fixups for it. 9646 and unit test for addr_in_common(). 9647 - 0.8: access-control config file element. 9648 and unit test rpl replay file. 9649 - 0.8: fixup address reporting from netevent. 9650 965116 November 2007: Wouter 9652 - privilege separation is not needed in unbound at this time. 9653 TODO item marked as such. 9654 - created beta-0.7 branch for support. 9655 - tagged 0.7 for beta release. 9656 - moved trunk to 0.8 for 0.8(auth features) development. 9657 - 0.8: access control list setup. 9658 965915 November 2007: Wouter 9660 - review fixups from Jelte. 9661 966214 November 2007: Wouter 9663 - testbed script does not recreate configure, since its in svn now. 9664 - fixup checkconf test so that it does not test 9665 /etc/unbound/unbound.conf. 9666 - tag 0.6. 9667 966813 November 2007: Wouter 9669 - remove debug print. 9670 - fixup testbound exit when LIBEVENT_SIGNAL_PROBLEM exists. 9671 967212 November 2007: Wouter 9673 - fixup signal handling where SIGTERM could be ignored if a SIGHUP 9674 arrives later on. 9675 - bugreports to unbound-bugs@nlnetlabs.nl 9676 - fixup testbound so it exits cleanly. 9677 - cleanup the caches on a reload, so that rrsetID numbers won't clash. 9678 96799 November 2007: Wouter 9680 - took ldns snapshot in repo. 9681 - default config file is /etc/unbound/unbound.conf. 9682 If it doesn't exist, it is installed with the doc/example.conf file. 9683 The file is not deleted on uninstall. 9684 - default listening is not all, but localhost interfaces. 9685 96868 November 2007: Wouter 9687 - Fixup chroot and drop user privileges. 9688 - new L root ip address in default hints. 9689 96901 November 2007: Wouter 9691 - Fixup of crash on reload, due to anchors in env not NULLed after 9692 dealloc during deinit. 9693 - Fixup of chroot call. Happens after privileges are dropped, so 9694 that checking the passwd entry still works. 9695 - minor touch up of clear() hashtable function. 9696 - VERB_DETAIL prints out what chdir, username, chroot is being done. 9697 - when id numbers run out, caches are cleared, as in design notes. 9698 Tested with a mock setup with very few bits in id, it worked. 9699 - harden-dnssec-stripped: yes is now default. It insists on dnssec 9700 data for trust anchors. Included tests for the feature. 9701 970231 October 2007: Wouter 9703 - cache-max-ttl config option. 9704 - building outside sourcedir works again. 9705 - defaults more secure: 9706 username: "unbound" 9707 chroot: "/etc/unbound" 9708 The operator can override them to be less secure ("") if necessary. 9709 - fix horrible oversight in sorting rrset references in a message, 9710 sort per reference key pointer, not on referencepointer itself. 9711 - pidfile: "/etc/unbound/unbound.pid" is now the default. 9712 - tests changed to reflect the updated default. 9713 - created hashtable clear() function that respects locks. 9714 971530 October 2007: Wouter 9716 - fixup assertion failure that relied on compressed names to be 9717 smaller than uncompressed names. A packet from comrite.com was seen 9718 to be compressed to a larger size. Added it as unit test. 9719 - quieter logging at low verbosity level for common tcp messages. 9720 - no greedy TTL update. 9721 972223 October 2007: Wouter 9723 - fixup (grand-)parent problem for dnssec-lameness detection. 9724 - fixup tests to do additional section processing for lame replies, 9725 since the detection needs that. 9726 - no longer trust in query section in reply during dnssec lame detect. 9727 - dnssec lameness does not make the server never ever queried, but 9728 non-preferred. If no other servers exist or answer, the dnssec lame 9729 server is used; the fastest dnssec lame server is chosen. 9730 - added test then when trust anchor cannot be primed (nodata), the 9731 insecure mode from unbound works. 9732 - Fixup max queries per thread, any more are dropped. 9733 973422 October 2007: Wouter 9735 - added donotquerylocalhost config option. Can be turned off for 9736 out test cases. 9737 - ISO C compat changes. 9738 - detect RA-no-AA lameness, as LAME. 9739 - DNSSEC-lameness detection, as LAME. 9740 See notes in requirements.txt for choices made. 9741 - tests for lameness detection. 9742 - added all to make test target; need unbound for fwd tests. 9743 - testbound does not pollute /etc/unbound. 9744 974519 October 2007: Wouter 9746 - added configure (and its files) to svn, so that the trunk is easier 9747 to use. ./configure, config.guess, config.sub, ltmain.sh, 9748 and config.h.in. 9749 - added yacc/lex generated files, util/configlexer.c, 9750 util/configparser.c util/configparser.h, to svn. 9751 - without lex no attempt to use it. 9752 - unsecure response validation collated into one block. 9753 - remove warning about const cast of cfgfile name. 9754 - outgoing-interfaces can be different from service interfaces. 9755 - ldns-src configure is done during unbound configure and 9756 ldns-src make is done during unbound make, and so inherits the 9757 make arguments from the unbound make invocation. 9758 - nicer error when libevent problem causes instant exit on signal. 9759 - read root hints from a root hint file (like BIND does). 9760 976118 October 2007: Wouter 9762 - addresses are logged with errors. 9763 - fixup testcode fake event to remove pending before callback 9764 since the callback may create new pending items. 9765 - tests updated because retries are now in iterator module. 9766 - ldns-testpkts code is checked for differences between unbound 9767 and ldns by makedist.sh. 9768 - ldns trunk from today added in svn repo for fallback in case 9769 no ldns is installed on the system. 9770 make download_ldns refreshes the tarball with ldns svn trunk. 9771 - ldns-src.tar.gz is used if no ldns is found on the system, and 9772 statically linked into unbound. 9773 - start of regional allocator code. 9774 - regional uses less memory and variables, simplified code. 9775 - remove of region-allocator. 9776 - alloc cache keeps a cache of recently released regional blocks, 9777 up to a maximum. 9778 - make unit test cleanly free memory. 9779 978017 October 2007: Wouter 9781 - fixup another cycle detect and ns-addr timeout resolution bug. 9782 This time by refusing delegations from the cache without addresses 9783 when resolving a mandatory-glue nameserver-address for that zone. 9784 We're going to have to ask a TLD server anyway; might as well be 9785 the TLD server for this name. And this resolves a lot of cases where 9786 the other nameserver names lead to cycles or are not available. 9787 - changed random generator from random(3) clone to arc4random wrapped 9788 for thread safety. The random generator is initialised with 9789 entropy from the system. 9790 - fix crash where failure to prime DNSKEY tried to print null pointer 9791 in the log message. 9792 - removed some debug prints, only verb_algo (4) enables them. 9793 - fixup test; new random generator took new paths; such as one 9794 where no scripted answer was available. 9795 - mark insecure RRs as insecure. 9796 - fixup removal of nonsecure items from the additional. 9797 - reduced timeout values to more realistic, 376 msec (262 msec has 9798 90% of roundtrip times, 512 msec has 99% of roundtrip times.) 9799 - server selection failover to next server after timeout (376 msec). 9800 980116 October 2007: Wouter 9802 - no malloc in log_hex. 9803 - assertions around system calls. 9804 - protect against gethostname without ending zero. 9805 - ntop output is null terminated by unbound. 9806 - pidfile content null termination 9807 - various snprintf use sizeof(stringbuf) instead of fixed constant. 9808 - changed loopdetect % 8 with & 0x7 since % can become negative for 9809 weird negative input and particular interpretation of integer math. 9810 - dname_pkt_copy checks length of result, to protect result buffers. 9811 prints an error, this should not happen. Bad strings should have 9812 been rejected earlier in the program. 9813 - remove a size_t underflow from msgreply size func. 9814 981515 October 2007: Wouter 9816 - nicer warning. 9817 - fix IP6 TCP, wrong definition check. With test package. 9818 - fixup the fact that the query section was not compressed to, 9819 the code was there but was called by value instead of by reference. 9820 And test for the case, uses xxd and nc. 9821 - more portable ip6 check for sockaddr types. 9822 98238 October 2007: Wouter 9824 - --disable-rpath option in configure for 64bit systems with 9825 several dynamic lib dirs. 9826 98277 October 2007: Wouter 9828 - fixup tests for no AD bit in non-DO queries. 9829 - test that makes sure AD bit is not set on non-DO query. 9830 98316 October 2007: Wouter 9832 - removed logfile open early. It did not have the proper permissions; 9833 it was opened as root instead of the user. And we cannot change user 9834 id yet, since chroot and bind ports need to be done. 9835 - callback checks for event callbacks done from mini_event. Because 9836 of deletions cannot do this from netevent. This means when using 9837 libevent the protection does not work on event-callbacks. 9838 - fixup too small reply (did not zero counts). 9839 - fixup reply no longer AD bit when query without DO bit. 9840 98415 October 2007: Wouter 9842 - function pointer whitelist. 9843 98444 October 2007: Wouter 9845 - overwrite sensitive random seed value after use. 9846 - switch to logfile very soon if not -d (console attached). 9847 - error messages do not reveal the trustanchor contents. 9848 - start work on function pointer whitelists. 9849 98503 October 2007: Wouter 9851 - fix for multiple empty nonterminals, after multiple DSes in the 9852 chain of trust. 9853 - mesh checks if modules are looping, and stops them. 9854 - refetch with CNAMEd nameserver address regression test added. 9855 - fixup line count bug in testcode, so testbound prints correct line 9856 number with parse errors. 9857 - unit test for multiple ENT case. 9858 - fix for cname out of validated unsec zone. 9859 - fixup nasty id=0 reuse. Also added assertions to detect its 9860 return (the assertion catches in the existing test cases). 9861 98621 October 2007: Wouter 9863 - skip F77, CXX, objC tests in configure step. 9864 - fixup crash in refetch glue after a CNAME. 9865 and protection against similar failures (with error print). 9866 986728 September 2007: Wouter 9868 - test case for unbound-checkconf, fixed so it also checks the 9869 interface: statements. 9870 987126 September 2007: Wouter 9872 - SIGHUP will reopen the log file. 9873 - Option to log to syslog. 9874 - please lint, fixup tests (that went to syslog on open, oops). 9875 - config check program. 9876 987725 September 2007: Wouter 9878 - tests for NSEC3. Fixup bitmap checks for NSEC3. 9879 - positive ANY response needs to check if wildcard expansion, and 9880 check that original data did not exist. 9881 - tests for NSEC3 that wrong use of OPTOUT is bad. For insecure 9882 delegation, for abuse of child zone apex nsec3. 9883 - create 0.5 release tag. 9884 988524 September 2007: Wouter 9886 - do not make test programs by default. 9887 - But 'make test' will perform all of the tests. 9888 - Advertise builtin select libevent alternative when no libevent 9889 is found. 9890 - signit can generate NSEC3 hashes, for generating tests. 9891 - multiple nsec3 parameters in message test. 9892 - too high nsec3 iterations becomes insecure test. 9893 989421 September 2007: Wouter 9895 - fixup empty_DS_name allocated in wrong region (port DEC Alpha). 9896 - fixup testcode lock safety (port FreeBSD). 9897 - removes subscript has type char warnings (port Solaris 9). 9898 - fixup of field with format type to int (port MacOS/X intel). 9899 - added test for infinite loop case in nonRD answer validation. 9900 It was a more general problem, but hard to reproduce. When an 9901 unsigned rrset is being validated and the key fetched, the DS 9902 sequence is followed, but if the final name has no DS, then no 9903 proof is possible - the signature has been stripped off. 9904 990520 September 2007: Wouter 9906 - fixup and test for NSEC wildcard with empty nonterminals. 9907 - makedist.sh fixup for svn info. 9908 - acl features request in plan. 9909 - improved DS empty nonterminal handling. 9910 - compat with ANS nxdomain for empty nonterminals. Attempts the nodata 9911 proof anyway, which succeeds in ANS failure case. 9912 - striplab protection in case it becomes -1. 9913 - plans for static and blacklist config. 9914 991519 September 2007: Wouter 9916 - comments about non-packed usage. 9917 - plan for overload support in 0.6. 9918 - added testbound tests for a failed resolution from the logs 9919 and for failed prime when missing glue. 9920 - fixup so useless delegation points are not returned from the 9921 cache. Also the safety belt is used if priming fails to complete. 9922 - fixup NSEC rdata not to be lowercased, bind compat. 9923 992418 September 2007: Wouter 9925 - wildcard nsec3 testcases, and fixup to get correct wildcard name. 9926 - validator prints subtype classification for debug. 9927 992817 September 2007: Wouter 9929 - NSEC3 hash cache unit test. 9930 - validator nsec3 nameerror test. 9931 993214 September 2007: Wouter 9933 - nsec3 nodata proof, nods proof, wildcard proof. 9934 - nsec3 support for cname chain ending in noerror or nodata. 9935 - validator calls nsec3 proof routines if no NSECs prove anything. 9936 - fixup iterator bug where it stored the answer to a cname under 9937 the wrong qname into the cache. When prepending the cnames, the 9938 qname has to be reset to the original qname. 9939 994013 September 2007: Wouter 9941 - nsec3 find matching and covering, ce proof, prove namerror msg. 9942 994312 September 2007: Wouter 9944 - fixup of manual page warnings, like for NSD bugreport. 9945 - nsec3 work, config, max iterations, filter, and hash cache. 9946 99476 September 2007: Wouter 9948 - fixup to find libevent on mac port install. 9949 - fixup size_t vs unsigned portability in validator/sigcrypt. 9950 - please compiler on different platforms, for unreachable code. 9951 - val_nsec3 file. 9952 - pthread_rwlock type is optional, in case of old pthread libs. 9953 99545 September 2007: Wouter 9955 - cname, name error validator tests. 9956 - logging of qtype ANY works. 9957 - ANY type answers get RRSIG in answer section of replies (but not 9958 in other sections, unless DO bit is on). 9959 - testbound can replay a TCP query (set MATCH TCP in the QUERY). 9960 - DS and noDS referral validation test. 9961 - if you configure many trust anchors, parent trust anchors can 9962 securely deny existence of child trust anchors, if validated. 9963 - not all *.name NSECs are present because a wildcard was matched, 9964 and *.name NSECs can prove nodata for empty nonterminals. 9965 Also, for wildcard name NSECs, check they are not from the parent 9966 zone (for wildcarded zone cuts), and check absence of CNAME bit, 9967 for a nodata proof. 9968 - configure option for memory allocation debugging. 9969 - port configure option for memory allocation to solaris10. 9970 99714 September 2007: Wouter 9972 - fixup of Leakage warning when serviced queries processed multiple 9973 callbacks for the same query from the same server. 9974 - testbound removes config file from /tmp on failed exit. 9975 - fixup for referral cleanup of the additional section. 9976 - tests for cname, referral validation. 9977 - neater testbound tpkg output. 9978 - DNAMEs no longer match their apex when synthesized from the cache. 9979 - find correct signer name for DNAME responses. 9980 - wildcarded DNAME test and fixup code to detect. 9981 - prepend NSEC and NSEC3 rrsets in the iterator while chasing CNAMEs. 9982 So that wildcarded CNAMEs get their NSEC with them to the answer. 9983 - test for a CNAME to a DNAME to a CNAME to an answer, all from 9984 different domains, for key fetching and signature checking of 9985 CNAME'd messages. 9986 99873 September 2007: Wouter 9988 - Fixed error in iterator that would cause assertion failure in 9989 validator. CNAME to a NXDOMAIN response was collated into a response 9990 with both a CNAME and the NXDOMAIN rcode. Added a test that the 9991 rcode is changed to NOERROR (because of the CNAME). 9992 - timeout on tcp does not lead to spurious leakage detect. 9993 - account memory for name of lame zones, so that memory leakages does 9994 not show lame cache growth as a leakage growth. 9995 - config setting for lameness cache expressed in bytes, instead of 9996 number of entries. 9997 - tool too summarize allocations per code line. 9998 999931 August 2007: Wouter 10000 - can read bind trusted-keys { ... }; files, in a compatibility mode. 10001 - iterator should not detach target queries that it still could need. 10002 the protection against multiple outstanding queries is moved to a 10003 current_query num check. 10004 - validator nodata, positive, referral tests. 10005 - dname print can print '*' wildcard. 10006 1000730 August 2007: Wouter 10008 - fixup override date config option. 10009 - config options to control memory usage. 10010 - caught bad free of un-alloced data in worker_send error case. 10011 - memory accounting for key cache (trust anchors and temporary cache). 10012 - memory accounting fixup for outside network tcp pending waits. 10013 - memory accounting fixup for outside network tcp callbacks. 10014 - memory accounting for iterator fixed storage. 10015 - key cache size and slabs config options. 10016 - lib crypto cleanups at exit. 10017 1001829 August 2007: Wouter 10019 - test tool to sign rrsets for testing validator with. 10020 - added RSA and DSA test keys, public and private pairs, 512 bits. 10021 - default configuration is with validation enabled. 10022 Only a trust-anchor needs to be configured for DNSSEC to work. 10023 - do not convert to DER for DSA signature verification. 10024 - validator replay test file, for a DS to DNSKEY DSA key prime and 10025 positive response. 10026 1002728 August 2007: Wouter 10028 - removed double use for udp buffers, that could fail, 10029 instead performs a malloc to do the backup. 10030 - validator validates referral messages, by validating all the rrsets 10031 and stores the rrsets in the cache. Further referral (nonRD queries) 10032 replies are made from the rrset cache directly. Unless unchecked 10033 rrsets are encountered, there are then validated. 10034 - enforce that signing is done by a parent domain (or same domain). 10035 - adjust TTL downwards if rrset TTL bigger than signature allows. 10036 - permissive mode feature, sets AD bit for secure, but bogus does 10037 not give servfail (bogus is changed into indeterminate). 10038 - optimization of rrset verification. rr canonical sorting is reused, 10039 for the same rrset. canonical rrset image in buffer is reused for 10040 the same signature. 10041 - if the rrset is too big (64k exactly + large owner name) the 10042 canonicalization routine will fail if it does not fit in buffer. 10043 - faster verification for large sigsets. 10044 - verb_detail mode reports validation failures, but not the entire 10045 algorithm for validation. Key prime failures are reported as 10046 verb_ops level. 10047 1004827 August 2007: Wouter 10049 - do not garble the edns if a cache answer fails. 10050 - answer norecursive from cache if possible. 10051 - honor clean_additional setting when returning secure non-recursive 10052 referrals. 10053 - do not store referral in msg cache for nonRD queries. 10054 - store verification status in the rrset cache to speed up future 10055 verification. 10056 - mark rrsets indeterminate and insecure if they are found to be so. 10057 and store this in the cache. 10058 1005924 August 2007: Wouter 10060 - message is bogus if unsecure authority rrsets are present. 10061 - val-clean-additional option, so you can turn it off. 10062 - move rrset verification out of the specific proof types into one 10063 routine. This makes the proof routines prettier. 10064 - fixup cname handling in validator, cname-to-positive and cname-to- 10065 nodata work. 10066 - Do not synthesize DNSKEY and DS responses from the rrset cache if 10067 the rrset is from the additional section. Signatures may have 10068 fallen off the packet, and cause validation failure. 10069 - more verbose signature date errors (with the date attached). 10070 - increased default infrastructure cache size. It is important for 10071 performance, and 1000 entries are only 212k (or a 400 k total cache 10072 size). To 10000 entries (for 2M entries, 4M cache size). 10073 1007423 August 2007: Wouter 10075 - CNAME handling - move needs_validation to before val_new(). 10076 val_new() setups the chase-reply to be an edited copy of the msg. 10077 new classification, and find signer can find for it. 10078 removal of unsigned crap from additional, and query restart for 10079 cname. 10080 - refuse to follow wildcarded DNAMEs when validating. 10081 But you can query for qtype ANY, or qtype DNAME and validate that. 10082 1008322 August 2007: Wouter 10084 - bogus TTL. 10085 - review - use val_error(). 10086 1008721 August 2007: Wouter 10088 - ANY response validation. 10089 - store security status in cache. 10090 - check cache security status and either send the query to be 10091 validated, return the query to client, or send servfail to client. 10092 Sets AD bit on validated replies. 10093 - do not examine security status on an error reply in mesh_done. 10094 - construct DS, DNSKEY messages from rrset cache. 10095 - manual page entry for override-date. 10096 1009720 August 2007: Wouter 10098 - validate and positive validation, positive wildcard NSEC validation. 10099 - nodata validation, nxdomain validation. 10100 1010118 August 2007: Wouter 10102 - process DNSKEY response in FINDKEY state. 10103 1010417 August 2007: Wouter 10105 - work on DS2KE routine. 10106 - val_nsec.c for validator NSEC proofs. 10107 - unit test for NSEC bitmap reading. 10108 - dname iswild and canonical_compare with unit tests. 10109 1011016 August 2007: Wouter 10111 - DS sig unit test. 10112 - latest release libevent 1.3c and 1.3d have threading fixed. 10113 - key entry fixup data pointer and ttl absolute. 10114 - This makes a key-prime succeed in validator, with DS or DNSKEY as 10115 trust-anchor. 10116 - fixup canonical compare byfield routine, fix bug and also neater. 10117 - fixed iterator response type classification for queries of type 10118 ANY and NS. 10119 dig ANY gives sometimes NS rrset in AN and NS section, and parser 10120 removes the NS section duplicate. dig NS gives sometimes the NS 10121 in the answer section, as referral. 10122 - validator FINDKEY state. 10123 1012415 August 2007: Wouter 10125 - crypto calls to verify signatures. 10126 - unit test for rrsig verification. 10127 1012814 August 2007: Wouter 10129 - default outgoing ports changed to avoid port 2049 by default. 10130 This port is widely blocked by firewalls. 10131 - count infra lameness cache in memory size. 10132 - accounting of memory improved 10133 - outbound entries are allocated in the query region they are for. 10134 - extensive debugging for memory allocations. 10135 - --enable-lock-checks can be used to enable lock checking. 10136 - protect undefs in config.h from autoheaders ministrations. 10137 - print all received udp packets. log hex will print on multiple 10138 lines if needed. 10139 - fixed error in parser with backwards rrsig references. 10140 - mark cycle targets for iterator did not have CD flag so failed 10141 its task. 10142 1014313 August 2007: Wouter 10144 - fixup makefile, if lexer is missing give nice error and do not 10145 mess up the dependencies. 10146 - canonical compare routine updated. 10147 - canonical hinfo compare. 10148 - printout list of the queries that the mesh is working on. 10149 1015010 August 2007: Wouter 10151 - malloc and free overrides that track total allocation and frees. 10152 for memory debugging. 10153 - work on canonical sort. 10154 101559 August 2007: Wouter 10156 - canonicalization, signature checks 10157 - dname signature label count and unit test. 10158 - added debug heap size print to memory printout. 10159 - typo fixup in worker.c 10160 - -R needed on solaris. 10161 - validator override option for date check testing. 10162 101638 August 2007: Wouter 10164 - ldns _raw routines created (in ldns trunk). 10165 - sigcrypt DS digest routines 10166 - val_utils uses sigcrypt to perform signature cryptography. 10167 - sigcrypt keyset processing 10168 101697 August 2007: Wouter 10170 - security status type. 10171 - security status is copied when rdata is equal for rrsets. 10172 - rrset id is updated to invalidate all the message cache entries 10173 that refer to NSEC, NSEC3, DNAME rrsets that have changed. 10174 - val_util work 10175 - val_sigcrypt file for validator signature checks. 10176 101776 August 2007: Wouter 10178 - key cache for validator. 10179 - moved isroot and dellabel to own dname routines, with unit test. 10180 101813 August 2007: Wouter 10182 - replanning. 10183 - scrubber check section of lame NS set. 10184 - trust anchors can be in config file or read from zone file, 10185 DS and DNSKEY entries. 10186 - unit test trust anchor storage. 10187 - trust anchors converted to packed rrsets. 10188 - key entry definition. 10189 101902 August 2007: Wouter 10191 - configure change for latest libevent trunk version (needs -lrt). 10192 - query_done and walk_supers are moved out of module interface. 10193 - fixup delegation point duplicates. 10194 - fixup iterator scrubber; lame NS set is let through the scrubber 10195 so that the classification is lame. 10196 - validator module exists, and does nothing but pass through, 10197 with calling of next module and return. 10198 - validator work. 10199 102001 August 2007: Wouter 10201 - set version to 0.5 10202 - module work for module to module interconnections. 10203 - config of modules. 10204 - detect cycle takes flags. 10205 1020631 July 2007: Wouter 10207 - updated plan 10208 - release 0.4 tag. 10209 1021030 July 2007: Wouter 10211 - changed random state init, so that sequential process IDs are not 10212 cancelled out by sequential thread-ids in the random number seed. 10213 - the fwd_three test, which sends three queries to unbound, and 10214 unbound is kept waiting by ldns-testns for 3 seconds, failed 10215 because the retry timeout for default by unbound is 3 seconds too, 10216 it would hit that timeout and fail the test. Changed so that unbound 10217 is kept waiting for 2 seconds instead. 10218 1021927 July 2007: Wouter 10220 - removed useless -C debug option. It did not work. 10221 - text edit of documentation. 10222 - added doc/CREDITS file, referred to by the manpages. 10223 - updated planning. 10224 1022526 July 2007: Wouter 10226 - cycle detection, for query state dependencies. Will attempt to 10227 circumvent the cycle, but if no other targets available fails. 10228 - unit test for AXFR, IXFR response. 10229 - test for cycle detection. 10230 1023125 July 2007: Wouter 10232 - testbound read ADDRESS and check it. 10233 - test for version.bind and friends. 10234 - test for iterator chaining through several referrals. 10235 - test and fixup for refetch for glue. Refetch fails if glue 10236 is still not provided. 10237 1023824 July 2007: Wouter 10239 - Example section in config manual. 10240 - Addr stored for range and moment in replay. 10241 1024220 July 2007: Wouter 10243 - Check CNAME chain before returning cache entry with CNAMEs. 10244 - Option harden-glue, default is on. It will discard out of zone 10245 data. If disabled, performance is faster, but spoofing attempts 10246 become a possibility. Note that still normalize scrubbing is done, 10247 and that the potentially spoofed data is used for infrastructure 10248 and not returned to the client. 10249 - if glue times out, refetch by asking parent of delegation again. 10250 Much like asking for DS at the parent side. 10251 - TODO items from forgery-resilience draft. 10252 and on memory handling improvements. 10253 - renamed module_event_timeout to module_event_noreply. 10254 - memory reporting code; reports on memory usage after handling 10255 a network packet (not on cache replies). 10256 1025719 July 2007: Wouter 10258 - shuffle NS selection when getting nameserver target addresses. 10259 - fixup of deadlock warnings, yield cpu in checklock code so that 10260 freebsd scheduler selects correct process to run. 10261 - added identity and version config options and replies. 10262 - store cname messages complete answers. 10263 1026418 July 2007: Wouter 10265 - do not query addresses, 127.0.0.1, and ::1 by default. 10266 1026717 July 2007: Wouter 10268 - forward zone options in config file. 10269 - forward per zone in iterator. takes precedence over stubs. 10270 - fixup commithooks. 10271 - removed forward-to and forward-to-port features, subsumed by 10272 new forward zones. 10273 - fix parser to handle absent server: clause. 10274 - change untrusted rrset test to account for scrubber that is now 10275 applied during the test (which removes the poison, by the way). 10276 - feature, addresses can be specified with @portnumber, like nsd.conf. 10277 - test config files changed over to new forwarder syntax. 10278 1027927 June 2007: Wouter 10280 - delete of mesh does a postorder traverse of the tree. 10281 - found and fixed a memory leak. For TTL=0 messages, that would 10282 not be cached, instead the msg-replyinfo structure was leaked. 10283 - changed server selection so it will filter out hosts that are 10284 unresponsive. This is defined as a host with the maximum rto value. 10285 This means that unbound tried the host for retries up to 120 secs. 10286 The rto value will time out after host-ttl seconds from the cache. 10287 This keeps such unresolvable queries from taking up resources. 10288 - utility for keeping histogram. 10289 1029026 June 2007: Wouter 10291 - mesh is called by worker, and iterator uses it. 10292 This removes the hierarchical code. 10293 QueryTargets state and Finished state are merged for iterator. 10294 - forwarder mode no longer sets AA bit on first reply. 10295 - rcode in walk_supers is not needed. 10296 1029725 June 2007: Wouter 10298 - more mesh work. 10299 - error encode routine for ease. 10300 1030122 June 2007: Wouter 10302 - removed unused _node iterator value from rbtree_t. Takes up space. 10303 - iterator can handle querytargets state without a delegation point 10304 set, so that a priming(stub) subquery error can be handled. 10305 - iterator stores if it is priming or not. 10306 - log_query_info() neater logging. 10307 - changed iterator so that it does not alter module_qstate.qinfo 10308 but keeps a chase query info. Also query_flags are not altered, 10309 the iterator uses chase_flags. 10310 - fixup crash in case no ports for the family exist. 10311 1031221 June 2007: Wouter 10313 - Fixup secondary buffer in case of error callback. 10314 - cleanup slumber list of runnable states. 10315 - module_subreq_depth fails to work in slumber list. 10316 - fixup query release for cached results to sub targets. 10317 - neater error for tcp connection failure, shows addr in verbose. 10318 - rbtree_init so that it can be used with preallocated memory. 10319 1032020 June 2007: Wouter 10321 - new -C option to enable coredumps after forking away. 10322 - doc update. 10323 - fixup CNAME generation by scrubber, and memory allocation of it. 10324 - fixup deletion of serviced queries when all callbacks delete too. 10325 - set num target queries to 0 when you move them to slumber list. 10326 - typo in check caused subquery errors to be ignored, fixed. 10327 - make lint happy about rlim_t. 10328 - freeup of modules after freeup of module-states. 10329 - duplicate replies work, this uses secondary udp buffer in outnet. 10330 1033119 June 2007: Wouter 10332 - nicer layout in stats.c, review 0.3 change. 10333 - spelling improvement, review 0.3 change. 10334 - uncapped timeout for server selection, so that very fast or slow 10335 servers will stand out from the rest. 10336 - target-fetch-policy: "3 2 1 0 0" config setting. 10337 - fixup queries answered without RD bit (for root prime results). 10338 - refuse AXFR and IXFR requests. 10339 - fixup RD flag in error reply from iterator. fixup RA flag from 10340 worker error reply. 10341 - fixup encoding of very short edns buffer sizes, now sets TC bit. 10342 - config options harden-short-bufsize and harden-large-queries. 10343 1034418 June 2007: Wouter 10345 - same, move subqueries to slumber list when first has resolved. 10346 - fixup last fix for duplicate callbacks. 10347 - another offbyone in targetcounter. Also in Java prototype by the way. 10348 1034915 June 2007: Wouter 10350 - if a query asks to be notified of the same serviced query result 10351 multiple times, this will succeed. Only one callback will happen; 10352 multiple outbound-list entries result (but the double cleanup of it 10353 will not matter). 10354 - when iterator moves on due to CNAME or referral, it will remove 10355 the subqueries (for other targets). These are put on the slumber 10356 list. 10357 - state module wait subq is OK with no new subqs, an old one may have 10358 stopped, with an error, and it is still waiting for other ones. 10359 - if a query loops, halt entire query (easy way to clean up properly). 10360 1036114 June 2007: Wouter 10362 - num query targets was > 0 , not >= 0 compared, so that fetch 10363 policy of 0 did nothing. 10364 1036513 June 2007: Wouter 10366 - debug option: configure --enable-static-exe for compile where 10367 ldns and libevent are linked statically. Default is off. 10368 - make install and make uninstall. Works with static-exe and without. 10369 installation of unbound binary and manual pages. 10370 - alignment problem fix on solaris 64. 10371 - fixup address in case of TCP error. 10372 1037312 June 2007: Wouter 10374 - num target queries was set to 0 at a bad time. Default it to 0 and 10375 increase as target queries are done. 10376 - synthesize CNAME and DNAME responses from the cache. 10377 - Updated doxygen config for doxygen 1.5. 10378 - aclocal newer version. 10379 - doxygen 1.5 fixes for comments (for the strict check on docs). 10380 1038111 June 2007: Wouter 10382 - replies on TCP queries have the address field set in replyinfo, 10383 for serviced queries, because the initiator does not know that 10384 a TCP fallback has occured. 10385 - omit DNSSEC types from nonDO replies, except if qtype is ANY or 10386 if qtype directly queries for the type (and then only show that 10387 'unknown type' in the answer section). 10388 - fixed message parsing where rrsigs on their own would be put 10389 in the signature list over the rrsig type. 10390 103917 June 2007: Wouter 10392 - fixup error in double linked list insertion for subqueries and 10393 for outbound list of serviced queries for iterator module. 10394 - nicer printout of outgoing port selection. 10395 - fixup cname target readout. 10396 - nicer debug output. 10397 - fixup rrset counts when prepending CNAMEs to the answer. 10398 - fixup rrset TTL for prepended CNAMEs. 10399 - process better check for looping modules, and which submodule to 10400 run next. 10401 - subreq insertion code fixup for slumber list. 10402 - VERB_DETAIL, verbosity: 2 level gives short but readable output. 10403 VERB_ALGO, verbosity: 3 gives extensive output. 10404 - fixup RA bit in cached replies. 10405 - fixup CNAME responses from the cache no longer partial response. 10406 - error in network send handled without leakage. 10407 - enable ip6 from config, and try ip6 addresses if available, 10408 if ip6 is not connected, skips to next server. 10409 104105 June 2007: Wouter 10411 - iterator state finished. 10412 - subrequests without parent store in cache and stop. 10413 - worker slumber list for ongoing promiscuous queries. 10414 - subrequest error handling. 10415 - priming failure returns SERVFAIL. 10416 - priming gives LAME result, returns SERVFAIL. 10417 - debug routine to print dns_msg as handled by iterator. 10418 - memleak in config file stubs fixup. 10419 - more small bugs, in scrubber, query compare no ID for lookup, 10420 in dname validation for NS targets. 10421 - sets entry.key for new special allocs. 10422 - lognametypeclass can display unknown types and classes. 10423 104244 June 2007: Wouter 10425 - random selection of equally preferred nameserver targets. 10426 - reply info copy routine. Reuses existing code. 10427 - cache lameness in response handling. 10428 - do not touch qstate after worker_process_query because it may have 10429 been deleted by that routine. 10430 - Prime response state. 10431 - Process target response state. 10432 - some memcmp changed to dname_compare for case preservation. 10433 104341 June 2007: Wouter 10435 - normalize incoming messages. Like unbound-java, with CNAME chain 10436 checked, DNAME checked, CNAME's synthesized, glue checked. 10437 - sanitize incoming messages. 10438 - split msgreply encode functions into own file msgencode.c. 10439 - msg_parse to queryinfo/replyinfo conversion more versatile. 10440 - process_response, classify response, delegpt_from_message. 10441 1044231 May 2007: Wouter 10443 - querytargets state. 10444 - dname_subdomain_c() routine. 10445 - server selection, based on RTT. ip6 is filtered out if not available, 10446 and lameness is checked too. 10447 - delegation point copy routine. 10448 1044930 May 2007: Wouter 10450 - removed FLAG_CD from message and rrset caches. This was useful for 10451 an agnostic forwarder, but not for a sophisticated (trust value per 10452 rrset enabled) cache. 10453 - iterator response typing. 10454 - iterator cname handle. 10455 - iterator prime start. 10456 - subquery work. 10457 - processInitRequest and processInitRequest2. 10458 - cache synthesizes referral messages, with DS and NSEC. 10459 - processInitRequest3. 10460 - if a request creates multiple subrequests these are all activated. 10461 1046229 May 2007: Wouter 10463 - routines to lock and unlock array of rrsets moved to cache/rrset. 10464 - lookup message from msg cache (and copy to region). 10465 - fixed cast error in dns msg lookup. 10466 - message with duplicate rrset does not increase its TTLs twice. 10467 - 'qnamesize' changed to 'qname_len' for similar naming scheme. 10468 1046925 May 2007: Wouter 10470 - Acknowledge use of unbound-java code in iterator. Nicer readme. 10471 - services/cache/dns.c DNS Cache. Hybrid cache uses msgcache and 10472 rrset cache from module environment. 10473 - packed rrset key has type and class as easily accessible struct 10474 members. They are still kept in network format for fast msg encode. 10475 - dns cache find_delegation routine. 10476 - iterator main functions setup. 10477 - dns cache lookup setup. 10478 1047924 May 2007: Wouter 10480 - small changes to prepare for subqueries. 10481 - iterator forwarder feature separated out. 10482 - iterator hints stub code, config file stub code, so that first 10483 testing can proceed locally. 10484 - replay tests now have config option to enable forwarding mode. 10485 1048623 May 2007: Wouter 10487 - outside network does precise timers for roundtrip estimates for rtt 10488 and for setting timeout for UDP. Pending_udp takes milliseconds. 10489 - cleaner iterator sockaddr conversion of forwarder address. 10490 - iterator/iter_utils and iter_delegpt setup. 10491 - root hints. 10492 1049322 May 2007: Wouter 10494 - outbound query list for modules and support to callback with the 10495 outbound entry to the module. 10496 - testbound support for new serviced queries. 10497 - test for retry to TCP cannot use testbound any longer. 10498 - testns test for EDNS fallback, test for TCP fallback already exists. 10499 - fixes for no-locking compile. 10500 - mini_event timer precision and fix for change in timeouts during 10501 timeout callback. Fix for fwd_three tests, performed nonexit query. 10502 1050321 May 2007: Wouter 10504 - small comment on hash table locking. 10505 - outside network serviced queries, contain edns and tcp fallback, 10506 and udp retries and rtt timing. 10507 1050816 May 2007: Wouter 10509 - lruhash_touch() would cause locking order problems. Fixup in 10510 lock-verify in case locking cycle is found. 10511 - services/cache/rrset.c for rrset cache code. 10512 - special rrset_cache LRU updating function that uses the rrset id. 10513 - no dependencies calculation when make clean is called. 10514 - config settings for infra cache. 10515 - daemon code slightly cleaner, only creates caches once. 10516 1051715 May 2007: Wouter 10518 - host cache code. 10519 - unit test for host cache. 10520 1052114 May 2007: Wouter 10522 - Port to OS/X and Dec Alpha. Printf format and alignment fixes. 10523 - extensive lock debug report on join timeout. 10524 - proper RTT calculation, in utility code. 10525 - setup of services/cache/infra, host cache. 10526 1052711 May 2007: Wouter 10528 - iterator/iterator.c module. 10529 - fixup to pass reply_info in testcode and in netevent. 10530 1053110 May 2007: Wouter 10532 - created release-0.3 svn tag. 10533 - util/module.h 10534 - fixed compression - no longer compresses root name. 10535 105369 May 2007: Wouter 10537 - outside network cleans up waiting tcp queries on exit. 10538 - fallback to TCP. 10539 - testbound replay with retry in TCP mode. 10540 - tpkg test for retry in TCP mode, against ldns-testns server. 10541 - daemon checks max number of open files and complains if not enough. 10542 - test where data expires in the cache. 10543 - compiletests: fixed empty body ifstatements in alloc.c, in case 10544 locks are disabled. 10545 105468 May 2007: Wouter 10547 - outgoing network keeps list of available tcp buffers for outgoing 10548 tcp queries. 10549 - outgoing-num-tcp config option. 10550 - outgoing network keeps waiting list of queries waiting for buffer. 10551 - netevent supports outgoing tcp commpoints, nonblocking connects. 10552 105537 May 2007: Wouter 10554 - EDNS read from query, used to make reply smaller. 10555 - advertised edns value constants. 10556 - EDNS BADVERS response, if asked for too high edns version. 10557 - EDNS extended error responses once the EDNS record from the query 10558 has successfully been parsed. 10559 105604 May 2007: Wouter 10561 - msgreply sizefunc is more accurate. 10562 - config settings for rrset cache size and slabs. 10563 - hashtable insert takes argument so that a thread can use its own 10564 alloc cache to store released keys. 10565 - alloc cache special_release() locks if necessary. 10566 - rrset trustworthiness type added. 10567 - thread keeps a scratchpad region for handling messages. 10568 - writev used in netevent to write tcp length and data after another. 10569 This saves a roundtrip on tcp replies. 10570 - test for one rrset updated in the cache. 10571 - test for one rrset which is not updated, as it is not deemed 10572 trustworthy enough. 10573 - test for TTL refreshed in rrset. 10574 105753 May 2007: Wouter 10576 - fill refs. Use new parse and encode to answer queries. 10577 - stores rrsets in cache. 10578 - uses new msgreply format in cache. 10579 105802 May 2007: Wouter 10581 - dname unit tests in own file and spread out neatly in functions. 10582 - more dname unit tests. 10583 - message encoding creates truncated TC flagged messages if they do 10584 not fit, and will leave out (whole)rrsets from additional if needed. 10585 105861 May 2007: Wouter 10587 - decompress query section, extremely lenient acceptance. 10588 But only for answers from other servers, not for plain queries. 10589 - compression and decompression test cases. 10590 - some stats added. 10591 - example.conf interface: line is changed from 127.0.0.1 which leads 10592 to problems if used (restricting communication to the localhost), 10593 to a documentation and test address. 10594 1059527 April 2007: Wouter 10596 - removed iov usage, it is not good for dns message encoding. 10597 - owner name compression more optimal. 10598 - rrsig owner name compression. 10599 - rdata domain name compression. 10600 1060126 April 2007: Wouter 10602 - floating point exception fix in lock-verify. 10603 - lint uses make dependency 10604 - fixup lint in dname owner domain name compression code. 10605 - define for offset range that can be compressed to. 10606 1060725 April 2007: Wouter 10608 - prettier code; parse_rrset->type kept in host byte order. 10609 - datatype used for hashvalue of converted rrsig structure. 10610 - unit test compares edns section data too. 10611 1061224 April 2007: Wouter 10613 - ttl per RR, for RRSIG rrsets and others. 10614 - dname_print debug function. 10615 - if type is not known, size calc will skip DNAME decompression. 10616 - RRSIG parsing and storing and putting in messages. 10617 - dnssec enabled unit tests (from nlnetlabs.nl and se queries). 10618 - EDNS extraction routine. 10619 1062020 April 2007: Wouter 10621 - code comes through all of the unit tests now. 10622 - disabled warning about spurious extra data. 10623 - documented the RRSIG parse plan in msgparse.h. 10624 - rrsig reading and outputting. 10625 1062619 April 2007: Wouter 10627 - fix unit test to actually to tests. 10628 - fix write iov helper, and fakevent code. 10629 - extra builtin testcase (small packet). 10630 - ttl converted to network format in packets. 10631 - flags converted correctly 10632 - rdatalen off by 2 error fixup. 10633 - uses less iov space for header. 10634 1063518 April 2007: Wouter 10636 - review of msgparse code. 10637 - smaller test cases. 10638 1063917 April 2007: Wouter 10640 - copy and decompress dnames. 10641 - store calculated hash value too. 10642 - routine to create message out of stored information. 10643 - util/data/msgparse.c for message parsing code. 10644 - unit test, and first fixes because of test. 10645 * forgot rrset_count addition. 10646 * did & of ptr on stack for memory position calculation. 10647 * dname_pkt_copy forgot to read next label length. 10648 - test from file and fixes 10649 * double frees fixed in error conditions. 10650 * types with less than full rdata allowed by parser. 10651 Some dynamic update packets seem to use it. 10652 1065316 April 2007: Wouter 10654 - following a small change in LDNS, parsing code calculates the 10655 memory size to allocate for rrs. 10656 - code to handle ID creation. 10657 1065813 April 2007: Wouter 10659 - parse routines. Code that parses rrsets, rrs. 10660 1066112 April 2007: Wouter 10662 - dname compare routine that preserves case, with unit tests. 10663 1066411 April 2007: Wouter 10665 - parse work - dname packet parse, msgparse, querysection parse, 10666 start of sectionparse. 10667 1066810 April 2007: Wouter 10669 - Improved alignment of reply_info packet, nice for 32 and 64 bit. 10670 - Put RRset counts in reply_info, because the number of RRs can change 10671 due to RRset updates. 10672 - import of region-allocator code from nsd. 10673 - set alloc special type to ub_packed_rrset_key. 10674 Uses lruhash entry overflow chain next pointer in alloc cache. 10675 - doxygen documentation for region-allocator. 10676 - setup for parse scratch data. 10677 106785 April 2007: Wouter 10679 - discussed packed rrset with Jelte. 10680 106814 April 2007: Wouter 10682 - moved to version 0.3. 10683 - added util/data/dname.c 10684 - layout of memory for rrsets. 10685 106863 April 2007: Wouter 10687 - detect sign of msghdr.msg_iovlen so that the cast to that type 10688 in netevent (which is there to please lint) can be correct. 10689 The type on several OSes ranges from int, int32, uint32, size_t. 10690 Detects unsigned or signed using math trick. 10691 - constants for DNS flags. 10692 - compilation without locks fixup. 10693 - removed include of unportable header from lookup3.c. 10694 - more portable use of struct msghdr. 10695 - casts for printf warning portability. 10696 - tweaks to tests to port them to the testbed. 10697 - 0.2 tag created. 10698 106992 April 2007: Wouter 10700 - check sizes of udp received messages, not too short. 10701 - review changes. Some memmoves can be memcpys: 4byte aligned. 10702 set id correctly on cached answers. 10703 - review changes msgreply.c, memleak on error condition. AA flag 10704 clear on cached reply. Lowercase queries on hashing. 10705 unit test on lowercasing. Test AA bit not set on cached reply. 10706 Note that no TTLs are managed. 10707 1070829 March 2007: Wouter 10709 - writev or sendmsg used when answering from cache. 10710 This avoids a copy of the data. 10711 - do not do useless byteswap on query id. Store reply flags in uint16 10712 for easier access (and no repeated byteswapping). 10713 - reviewed code. 10714 - configure detects and config.h includes sys/uio.h for writev decl. 10715 1071628 March 2007: Wouter 10717 - new config option: num-queries-per-thread. 10718 - added tpkg test for answering three queries at the same time 10719 using one thread (from the query service list). 10720 1072127 March 2007: Wouter 10722 - added test for cache and not cached answers, in testbound replays. 10723 - testbound can give config file and commandline options from the 10724 replay file to unbound. 10725 - created test that checks if items drop out of the cache. 10726 - added word 'partitioned hash table' to documentation on slab hash. 10727 A slab hash is a partitioned hash table. 10728 - worker can handle multiple queries at a time. 10729 1073026 March 2007: Wouter 10731 - config settings for slab hash message cache. 10732 - test for cached answer. 10733 - Fixup deleting fake answer from testbound list. 10734 1073523 March 2007: Wouter 10736 - review of yesterday's commits. 10737 - covered up memory leak of the entry locks. 10738 - answers from the cache correctly. Copies flags correctly. 10739 - sanity check for incoming query replies. 10740 - slabbed hash table. Much nicer contention, need dual cpu to see. 10741 1074222 March 2007: Wouter 10743 - AIX configure check. 10744 - lock-verify can handle references to locks that are created 10745 in files it has not yet read in. 10746 - threaded hash table test. 10747 - unit test runs lock-verify afterwards and checks result. 10748 - need writelock to update data on hash_insert. 10749 - message cache code, msgreply code. 10750 1075121 March 2007: Wouter 10752 - unit test of hash table, fixup locking problem in table_grow(). 10753 - fixup accounting of sizes for removing items from hashtable. 10754 - unit test for hash table, single threaded test of integrity. 10755 - lock-verify reports errors nicely. More quiet in operation. 10756 1075716 March 2007: Wouter 10758 - lock-verifier, checks consistent order of locking. 10759 1076014 March 2007: Wouter 10761 - hash table insert (and subroutines) and lookup implemented. 10762 - hash table remove. 10763 - unit tests for hash internal bin, lru functions. 10764 1076513 March 2007: Wouter 10766 - lock_unprotect in checklocks. 10767 - util/storage/lruhash.h for LRU hash table structure. 10768 1076912 March 2007: Wouter 10770 - configure.ac moved to 0.2. 10771 - query_info and replymsg util/data structure. 10772 107739 March 2007: Wouter 10774 - added rwlock writelock checking. 10775 So it will keep track of the writelock, and readlocks are enforced 10776 to not change protected memory areas. 10777 - log_hex function to dump hex strings to the logfile. 10778 - checklocks zeroes its destroyed lock after checking memory areas. 10779 - unit test for alloc. 10780 - identifier for union in checklocks to please older compilers. 10781 - created 0.1 tag. 10782 107838 March 2007: Wouter 10784 - Reviewed checklock code. 10785 107867 March 2007: Wouter 10787 - created a wrapper around thread calls that performs some basic 10788 checking for data race and deadlock, and basic performance 10789 contention measurement. 10790 107916 March 2007: Wouter 10792 - Testbed works with threading (different machines, different options). 10793 - alloc work, does the special type. 10794 107952 March 2007: Wouter 10796 - do not compile fork funcs unless needed. Otherwise will give 10797 type errors as their typedefs have not been enabled. 10798 - log shows thread numbers much more nicely (and portably). 10799 - even on systems with nonthreadsafe libevent signal handling, 10800 unbound will exit if given a signal. 10801 Reloads will not work, and exit is not graceful. 10802 - start of alloc framework layout. 10803 108041 March 2007: Wouter 10805 - Signals, libevent and threads work well, with libevent patch and 10806 changes to code (close after event_del). 10807 - set ipc pipes nonblocking. 10808 1080927 February 2007: Wouter 10810 - ub_thread_join portable definition. 10811 - forking is used if no threading is available. 10812 Tested, it works, since pipes work across processes as well. 10813 Thread_join is replaced with waitpid. 10814 - During reloads the daemon will temporarily handle signals, 10815 so that they do not result in problems. 10816 - Also randomize the outgoing port range for tests. 10817 - If query list is full, will stop selecting listening ports for read. 10818 This makes all threads service incoming requests, instead of one. 10819 No memory is leaking during reloads, service of queries, etc. 10820 - test that uses ldns-testns -f to test threading. Have to answer 10821 three queries at the same time. 10822 - with verbose=0 operates quietly. 10823 1082426 February 2007: Wouter 10825 - ub_random code used to select ID and port. 10826 - log code prints thread id. 10827 - unbound can thread itself, with reload(HUP) and quit working 10828 correctly. 10829 - don't open pipes for #0, doesn't need it. 10830 - listens to SIGTERM, SIGQUIT, SIGINT (all quit) and SIGHUP (reload). 10831 1083223 February 2007: Wouter 10833 - Can do reloads on sigHUP. Everything is stopped, and freed, 10834 except the listening ports. Then the config file is reread. 10835 And everything is started again (and listening ports if needed). 10836 - Ports for queries are shared. 10837 - config file added interface:, chroot: and username:. 10838 - config file: directory, logfile, pidfile. And they work too. 10839 - will daemonize by default now. Use -d to stay in the foreground. 10840 - got BSD random[256 state] code, made it threadsafe. util/random. 10841 1084222 February 2007: Wouter 10843 - Have a config file. Removed commandline options, moved to config. 10844 - tests use config file. 10845 1084621 February 2007: Wouter 10847 - put -c option in man page. 10848 - minievent fd array capped by FD_SETSIZE. 10849 1085020 February 2007: Wouter 10851 - Added locks code and pthread spinlock detection. 10852 - can use no locks, or solaris native thread library. 10853 - added yacc and lex configure, and config file parsing code. 10854 also makedist.sh, and manpage. 10855 - put include errno.h in config.h 10856 1085719 February 2007: Wouter 10858 - Created 0.0 svn tag. 10859 - added acx_pthread.m4 autoconf check for pthreads from 10860 the autoconf archive. It is GPL-with-autoconf-exception Licensed. 10861 You can specify --with-pthreads, or --without-pthreads to configure. 10862 1086316 February 2007: Wouter 10864 - Updated testbed script, works better by using make on remote end. 10865 - removed check decls, we can compile without them. 10866 - makefile supports LIBOBJ replacements. 10867 - docs checks ignore compat code. 10868 - added util/mini-event.c and .h, a select based alternative used with 10869 ./configure --with-libevent=no 10870 It is limited to 1024 file descriptors, and has less features. 10871 - will not create ip6 sockets if ip6 not on the machine. 10872 1087315 February 2007: Wouter 10874 - port to FreeBSD 4.11 Dec Alpha. Also works on Solaris 10 sparc64, 10875 Solaris 9, FreeBSD 6, Linux i386 and OSX powerpc. 10876 - malloc rndstate, so that it is aligned for access. 10877 - fixed rbtree cleanup with postorder traverse. 10878 - fixed pending messages are deleted when handled. 10879 - You can control verbosity; default is not verbose, every -v 10880 adds more verbosity. 10881 1088214 February 2007: Wouter 10883 - Included configure.ac changes from ldns. 10884 - detect (some) headers before the standards check. 10885 - do not use isblank to test c99, since its not available on solaris9. 10886 - review of testcode. 10887 * entries in a RANGE are no longer reversed. 10888 * print name of file with replay entry parse errors. 10889 - port to OSX: cast to int for some prints of sizet. 10890 - Makefile copies ldnstestpkts.c before doing dependencies on it. 10891 1089213 February 2007: Wouter 10893 - work on fake events, first fwd replay works. 10894 - events can do timeouts and errors on queries to servers. 10895 - test package that runs replay scenarios. 10896 1089712 February 2007: Wouter 10898 - work on fake events. 10899 109009 February 2007: Wouter 10901 - replay file reading. 10902 - fake event setup, it creates fake structures, and teardowns, 10903 added signal callbacks to reply to be able to fake those, 10904 and main structure of event replay routines. 10905 109068 February 2007: Wouter 10907 - added tcp test. 10908 - replay storage. 10909 - testcode/fake_event work. 10910 109117 February 2007: Wouter 10912 - return answer with the same ID as query was sent with. 10913 - created udp forwarder test. I've done some effort to make it perform 10914 quickly. After servers are created, no big sleep statements but 10915 it checks the logfiles to see if servers have come up. Takes 0.14s. 10916 - set addrlen value when calling recvfrom. 10917 - comparison of addrs more portable. 10918 - LIBEVENT option for testbed to set libevent directory. 10919 - work on tcp input. 10920 109216 February 2007: Wouter 10922 - reviewed code and improved in places. 10923 109245 February 2007: Wouter 10925 - Picked up stdc99 and other define tests from ldns. Improved 10926 POSIX define test to include getaddrinfo. 10927 - defined constants for netevent callback error code. 10928 - unit test for strisip6. 10929 109302 February 2007: Wouter 10931 - Created udp4 and udp6 port arrays to provide service for both 10932 address families. 10933 - uses IPV6_USE_MIN_MTU for udp6 ,IPV6_V6ONLY to make ip6 sockets. 10934 - listens on both ip4 and ip6 ports to provide correct return address. 10935 - worker fwder address filled correctly. 10936 - fixup timer code. 10937 - forwards udp queries and sends answer. 10938 109391 February 2007: Wouter 10940 - outside network more UDP work. 10941 - moved * closer to type. 10942 - comm_timer object and events. 10943 1094431 January 2007: Wouter 10945 - Added makedist.sh script to make release tarball. 10946 - Removed listen callback layer, did not add anything. 10947 - Added UDP recv to netevent, worker callback for udp. 10948 - netevent communication reply storage structure. 10949 - minimal query header sanity checking for worker. 10950 - copied over rbtree implementation from NSD (BSD licensed too). 10951 - outgoing network query service work. 10952 1095330 January 2007: Wouter 10954 - links in example/ldns-testpkts.c and .h for premade packet support. 10955 - added callback argument to listen_dnsport and daemon/worker. 10956 1095729 January 2007: Wouter 10958 - unbound.8 a short manpage. 10959 1096026 January 2007: Wouter 10961 - fixed memleak. 10962 - make lint works on BSD and Linux (openssl defines). 10963 - make tags works. 10964 - testbound program start. 10965 1096625 January 2007: Wouter 10967 - fixed lint so it may work on BSD. 10968 - put license into header of every file. 10969 - created verbosity flag. 10970 - fixed libevent configure flag. 10971 - detects event_base_free() in new libevent 1.2 version. 10972 - getopt in daemon. fatal_exit() and verbose() logging funcs. 10973 - created log_assert, that throws assertions to the logfile. 10974 - listen_dnsport service. Binds ports. 10975 1097624 January 2007: Wouter 10977 - cleaned up configure.ac. 10978 1097923 January 2007: Wouter 10980 - added libevent to configure to link with. 10981 - util/netevent setup work. 10982 - configure searches for libevent. 10983 - search for libs at end of configure (when other headers and types 10984 have been found). 10985 - doxygen works with ATTR_UNUSED(). 10986 - util/netevent implementation. 10987 1098822 January 2007: Wouter 10989 - Designed header file for network communication. 10990 1099116 January 2007: Wouter 10992 - added readme.svn and readme.tests. 10993 109944 January 2007: Wouter 10995 - Testbed script (run on multiple platforms the test set). 10996 Works on Sunos9, Sunos10, FreeBSD 6.1, Fedora core 5. 10997 - added unit test tpkg. 10998 109993 January 2007: Wouter 11000 - committed first set of files into subversion repository. 11001 svn co svn+ssh://unbound.net/svn/unbound 11002 You need a ssh login. There is no https access yet. 11003 - Added LICENSE, the BSD license. 11004 - Added doc/README with compile help. 11005 - main program stub and quiet makefile. 11006 - minimal logging service (to stderr). 11007 - added postcommit hook that serves emails. 11008 - added first test 00-lint. postcommit also checks if build succeeds. 11009 - 01-doc: doxygen doc target added for html docs. And stringent test 11010 on documented files, functions and parameters. 11011 1101215 December 2006: Wouter 11013 - Created Makefile.in and configure.ac. 11014